The IP attempted to use the Mail server to relay spam to other servers.

This malicious IP was reported for trying to intercept VoIP calls, a type of eavesdropping attack aimed at capturing sensitive information.

The IP attempted to perform HTTP Verb Tampering attacks on the Apache server.

The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

The IP was identified as operating a Registration Bot (REG-Bot), automating the creation of multiple fake accounts on various platforms.

It attempted to use the SASL server to relay spam.

This IP belongs to McKesson.

High Frequency POST Requests: Numerous or unusual POST requests in a short time span could indicate a dictionary or brute force attack on a login page.

POST /user/register: An attempt to register a new user or brute force the user registration form.

The IP attempted to send malware-infected attachments from the Mail server.

It partook in whaling attacks, specifically targeting high-profile users within our system.

The IP was discovered trying Server Message Block relay attacks to gain unauthorized SSH access.

It made multiple requests with the same Max-Forwards header.

GET /setup.php: Effort to locate setup files for PHP applications.

Repeated attempts to alter or delete log files to cover tracks.

Attempts to use automated scripts or tools for password cracking.

Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

This IP belongs to Lowe's.

The IP was seen engaging in a Slowloris attack, holding as many connections to the target web server open for as long as possible, eventually overloading the server.

It attempted to use the FTP server to relay data to other systems.

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

It attempted to flood the SIP server with REGISTER requests.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

This IP belongs to Goldman Sachs Group.