It attempted to perform a session hijacking attack on the SSH server.

It attempted to send emails with deceptive subject lines from the Postfix server.

The IP made multiple unsuccessful login attempts to the Postfix server in a short period of time.

This IP belongs to Shopify.

This IP injected exploit kit into our system, taking advantage of software vulnerabilities.

The IP actively participated in snowshoe spamming, spreading its spam output across many IPs and domains to avoid detection.

The IP showed unusual patterns in session IDs.

HTTP Request with Odd Timing: Very precisely timed HTTP requests could imply an automated tool or bot.

This IP had been flagged for attempting to manipulate server behaviour by injecting shellcodes.

The IP attempted a Rootkit installation to gain root access and control server activity.

This IP belongs to Berkshire Hathaway.

The malicious IP tried to brute force its way into the SASL authentication process.

The IP was found trying to maliciously clone the SSH certificates for privileged access.

A majority of our user base received phishing emails originated from this particular IP address.

It launched header-based exploits, attempting to manipulate HTTP headers to cause inappropriate server responses.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

We noticed the IP attempting to compromise our IoT devices by spreading IoT malware.

This IP belongs to Cigna.

This IP was reported for attempting a Man-in-the-Middle attack, intercepting and potentially altering communication between two parties.

The IP performed Covert Timing Channel attacks, gathering information about encrypted SSH traffic by analyzing packet timing.

The IP made repeated attempts to authenticate with the SIP server using different usernames.

This IP belongs to United Technologies.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

This IP belongs to Jabil.

This IP belongs to Alphabet.