It initiated the use of spambots, sending out large amounts of unsolicited mails from our server.

It launched Smurf Attacks, trying to overload our mail server by utilizing internet host IP network links.

It detected attempting time-based blind SQL injection, observing the server's response time to extract data.

The IP partook in Drive-by attacks, embedding malicious scripts on benign websites.

Multiple requests with identical POST parameters.

The IP attempted to send emails from the Mail server to blacklisted email addresses.

This IP has been identified as running a botnet targeting our server systems with ransomware.

It sent unusually large SIP packets, potentially indicating a buffer overflow attempt.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

Multiple login attempts using common or easily guessable passwords (like 'password123', 'admin', etc.).

Unexpected changes in the server configuration or installed software.

The IP attempted to login to the SASL server with an invalid username.

It made numerous requests to the same endpoint in a short time.

This IP belongs to FedEx.

The malicious IP was reported for attempting a SIP Proxy attack, using a SIP server to mask its true location and identity.

The IP attempted to perform a Kad network amplification attack on the SSH server.

The IP tried to carry out illegal 'HTTP Request Smuggling' to fool the Apache server.

GET /administrator.php: Attempting to access an admin interface.

The IP attempted session sidejacking, seeking to take over SSH sessions post-authentication.

Frequent password reset requests.

The IP attempted to use the FTP server to distribute malware.

This IP belongs to Deere.

Signal of DDoS Attacks: Multiple IP addresses sending a significantly high volume of traffic.

udden increase in account lockouts due to multiple failed login attempts.

The IP was actively seeking unpatched SSH software in hope of finding exploitable vulnerabilities.