The IP attempted to perform a replay attack on the SSH server.

This IP belongs to 3M.

This IP was seen scanning for open ports and vulnerabilities, a common reconnaissance activity before launching attacks.

It attempted to perform a credential stuffing attack on the SASL server.

The IP showed unusual patterns in referrer URLs.

It attempted to send emails from the Mail server to a large number of recipients.

The IP was involved in a RTP Bleeding attack, exploiting vulnerabilities in the VoIP server to listen to ongoing calls.

It made multiple requests with the same X-Requested-With header.

Malicious Script Execution: Execution attempts of suspicious scripts or encoded payloads often seen in URI parameters or request bodies.

The IP executed URL Obscuring, hiding malicious URLs within seemingly innocent mail links.

Multiple HTTP 401 Status Codes: This could indicate someone is repeatedly attempting to access resources that require valid credentials, possibly attempting to brute-force their way in.

The malicious IP tried to depreciate the reputation of our mail server by sending out numerous spam mails.

Purposefully tried to clog our mail server's resources by creating a mail loop configuration.

We noticed the IP attempting to compromise our IoT devices by spreading IoT malware.

The IP launched timing attacks, trying to understand our server timings for potential future exploits.

The IP address attempted delivering malicious packets to disrupt the system's operation.

It attempted to use the FTP server to distribute wireless cracking tools.

The IP exhibited unusual patterns in the Accept-Language header.

The IP launched exploitation attacks based on the infamous 'Heartbleed' OpenSSL cryptographic vulnerabilities.

The IP was seen trying to perform a Denial of Service (DoS) attack, attempting to make a machine or network resource unavailable to its intended users.

This IP exhibited malicious sophistication by employing multi-vector attacks.

It was discovered illicitly scanning the server for potential vulnerabilities.

It attempted to perform Session Prediction attacks on the Apache server.

This IP belongs to AT&T.

It was making constant NDR (Non-Deliverable Receipt) or backscatter attacks by generating large amount of invalid email addresses.