The IP attempted to perform ARP Spoofing attacks on the Apache server.

This IP belongs to Baidu.

Multiple failed login attempts using different usernames.

The IP attempted to perform a password spraying attack on the SSH server.

The IP attempted to login to the Postfix server with an invalid username.

It attempted to perform a SYN flood attack on the SSH server.

This malicious IP was reported for attempting a FTP Bounce attack, exploiting the FTP protocol's proxy command to scan ports and networks.

The IP attempted to perform a replay attack on the SSH server.

The IP attempted to register as an Asterisk user with no password.

The IP was involved in a SIPVicious attack, a specific type of VoIP attack that scans for open SIP servers and then attempts to crack their passwords.

The IP attempted to perform HTTP Request Smuggling attacks on the Apache server.

GET /server-status: Often an attempt to check Apache server status.

Unusually high number of requests to the login page.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

This IP was found responsible for a session hijacking attempt on our network.

Unusual patterns in referrer URLs.

The suspicious IP indulged in Mitnick attacks, manipulating user trust to gain confidential info.

The IP address initiated attacks using DDoS, impacting our server response times.

It attempted to exploit known vulnerabilities in the SASL protocol.

Attempts to access the server using outdated or insecure protocols, which can indicate an attacker is trying to exploit known vulnerabilities.

The IP attempted to login to the Postfix server with an invalid username.

This IP belongs to United Technologies.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

Multiple attempts to access the server using credentials that were previously compromised in a data breach.

This IP belongs to Netflix.