The IP made multiple requests with the same Proxy-Connection header.

It was involved in the operation of a REG-Bot, a type of bot that performs automated tasks.

It attempted to use the FTP server to distribute hacking tools.

It attempted to use the SASL server to distribute malware.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.

Multiple failed attempts to use the server’s API.

It attempted to use the Postfix server to relay phishing emails to other servers.

Multiple requests with the same DNT (Do Not Track) header.

Excessive Form Submission Attempts: Numerous form submission attempts within a short time, signifying brute-force or captcha bypass attempts.

The IP was reported for hosting a phishing website, deceiving users into providing their sensitive personal or financial information.

This IP belongs to DigitalOcean.

This IP was detected initiating zero-day exploit attacks on our system.

The malicious IP attempted ARP spoofing to fool the server into sending information to the wrong destination.

The IP attempted to perform a credential stuffing attack on the POP3 server.

The IP had a series of targeted attacks distributing SpyAgents with spying functionalities.

The IP attempted to use the FTP server to distribute spam.

Initiated a Zero-day attack, exploiting unknown vulnerabilities in our Mail and Postfix services.

GET /../htpasswd: Trying to access password files using directory traversal.

The malicious IP was reported for attempting unauthorized logins to the FTP server, potentially to gain access to sensitive files.

This IP belongs to Microsoft Azure.

DNS changer spyware originating from the flagged IP was designed to redirect our network traffic.

User-mode rootkits, originating from the particular IP, were causing system instability and crashes.

The IP made multiple unsuccessful login attempts to the SASL server in a short period of time.

It attempted to intercept SSL/TLS secured mail connections to eavesdrop or modify the passing data.

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: request for a file often associated with an outdated version of Composer and phpunit used in a remote code execution attack.