The IP made multiple unsuccessful login attempts to the Postfix server in a short period of time.

The IP address was flagged for employing a packet sniffer on our network.

This IP belongs to Xbox Live.

This IP belongs to Sysco.

It attempted to send emails from the Postfix server that violate the server's email content policy.

The IP attempted to perform a credential stuffing attack on the IMAP server.

It showed unusual activity in the server's error logs.

This IP belongs to Philip Morris International.

It initiated Denial of Service (DoS) attacks with an aim to overwhelm and crash the SSH service.

This IP belongs to Cardinal Health.

The IP attempted to use the Mail server to relay spam to other servers.

This IP belongs to Comcast.

The malicious IP initiated unauthorized Mail Queue access attempts, impacting mail service efficiency.

It attempted to perform Web Service attacks on the Apache server.

The IP was seen attempting a FTP Command Injection attack, inserting malicious commands into legitimate FTP requests.

This IP was seen scanning for open ports and vulnerabilities, a common reconnaissance activity before launching attacks.

Suspicious URL Encoding: Seeing HTTP requests with a lot of %, suggesting URL encoding to evade detection.

This IP belongs to New York Life Insurance.

The malicious IP was involved in a vishing attack, using the VoIP server to deceive users into revealing sensitive information.

GET /wp-config.php~: Requesting the backup files which may expose sensitive information.

Multiple failed login attempts from the same IP address.

This IP belongs to Exxon Mobil.

It attempted to perform a brute force attack on the POP3 server.

This IP belongs to Walmart.

Various incidents of unwanted installation of malicious gaming apps were traced back to this IP.