This IP belongs to Cox Communications.

It partook in whaling attacks, specifically targeting high-profile users within our system.

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

The detected IP address was responsible for the distribution of botnets aimed at automating data theft.

The IP attempted 'DLL Injection' to alter the server's behavior in a malicious manner.

This IP belongs to Amazon.

Our network security detected the IP spreading malicious macros through document files.

The IP was involved in a VoIP Hopping attack, jumping from one VoIP network to another to avoid detection or gain unauthorized access.

This IP belongs to Vkontakte.

The IP attempted to create new directories on the FTP server.

The IP made multiple requests with the same If-Match header.

The IP attempted to register with the VOIP server using an invalid username.

The IP attempted to perform a NetBIOS amplification attack on the SSH server.

This IP belongs to Dropbox.

The IP partook in Drive-by attacks, embedding malicious scripts on benign websites.

It attempted to send emails from the Mail server that violate the server's usage policy.

It attempted zero-day attacks, exploiting unknown vulnerabilities in pop3.

The IP was seen trying to perform a call transfer to an external number, a potential sign of toll fraud.

The IP engaged in an HTTP Desync attack, misaligning HTTP request and responses to yield SSH vulnerability.

GET /axis2/axis2-admin/login: Attempt at finding Axis2 web service exploitable applications.

It attempted to perform Session Prediction attacks on the Apache server.

It attempted to perform a replay attack on the SASL server.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

This malicious IP was reported for attempting to initiate a large number of simultaneous calls, a sign of a potential DDoS attack.

The IP attempted to send emails from the Mail server to blacklisted email addresses.