A sudden increase in the number of new user accounts, which can indicate an attacker has gained access and is creating backdoor accounts.

This IP belongs to America Movil.

The IP attempted to send emails from the Mail server pretending to be from a different sender.

The suspicious IP attempted to introduce spyware under the guise of software updates.

It attempted mail bombing, trying to overwhelm our mail server with high volumes of email.

It attempted command injection attacks, hoping to execute unauthorized commands.

This IP belongs to World Fuel Services.

An identity theft activity was linked back to this malicious IP.

The IP attempted to register as a VOIP user with no password.

This IP belongs to Marathon Petroleum.

This IP belongs to CVS Health.

The IP was engaged in email append attacks, trying to add addresses to an existing email or response mid-transit.

POST /j_security_check: May indicate an attempt to bypass Java server page (JSP) login mechanisms.

The malicious IP tried to brute force its way into the SASL authentication process.

The IP was involved in a phishing attack, creating a fake webpage to deceive users into providing their sensitive personal or financial information.

This IP belongs to Plusnet.

The IP attempted to perform a brute force attack on the SASL server.

The IP was seen trying to upload files to the FTP server, possibly with the intent of distributing malware.

This malicious IP was reported for attempting to perform a FTP Port Stealing attack, hijacking the data connection of an existing FTP session.

The IP attempted to use the FTP server to distribute DDoS attack tools.

This IP belongs to Apple.

It attempted to send phishing emails from the Postfix server.

There were several attempts from this IP to manipulate our server DNS records.

It attempted to use the VOIP server to perform a reflection DDoS attack.

The IP attempted to perform a replay attack on the IMAP server.