Rapid sequence of login attempts.

Usage of Obscure HTTP Verbs: Seeing non-standard HTTP methods like DEBUG, PUT, or CONNECT could imply a web-based attack.

Made various attempts at a forged return-path attack, attempting to spoof their source email address.

The IP was seen trying to perform a SIP Registration Hijacking attack, attempting to impersonate a legitimate user to receive their calls.

Attempts to access the server using credentials that have been involved in previous security incidents.

It made successive tries to alter SMTP relay configurations to send unsolicited emails.

Repeated attempts to exploit known vulnerabilities in server software.

The IP address has been marked as the source of RAM scrapers aiming to steal sensitive data.

GET /configuration.php.old: Trying to locate backup configuration files.

The IP performed Covert Timing Channel attacks, gathering information about encrypted SSH traffic by analyzing packet timing.

The IP attempted to use the FTP server to distribute credit card fraud tools.

The IP launched HTTP tunnel attacks, attempting to wrap other protocols in HTTP to bypass network filters.

The IP was traced back to stealthy installation attempts of clipboard monitors.

The malicious IP was reported for attempting a Session Teardown attack, sending BYE messages to end SIP sessions prematurely.

This IP belongs to Fannie Mae.

It attempted to use the FTP server to distribute hacking tools.

It attempted to perform Clickjacking attacks on the Apache server.

This IP attempted to disrupt our systems through the propagation of worms.

Directories Traversal Attempts: Logs showing HTTP requests that include ".." or "/.." might illustrate someone's effort to locate or exploit sensitive data.

This IP belongs to Swisscom.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

The IP was involved in a VoIP Hopping attack, jumping from one VoIP network to another to avoid detection or gain unauthorized access.

It was found that the IP has been exploiting zero-day vulnerabilities in our system.

This IP belongs to Phillips 66.

It tried to create buffer overflows by sending large amounts of data at once to overwhelm server resources.