It attempted to create new directories on the SSH server.

It attempted to perform a denial of service attack on the SSH server.

The IP launched exploitation attacks based on the infamous 'Heartbleed' OpenSSL cryptographic vulnerabilities.

The IP was engaged in email append attacks, trying to add addresses to an existing email or response mid-transit.

It sent Asterisk requests to non-existent extensions.

It attempted to login to the POP3 server with an invalid password.

This IP belongs to DuPont de Nemours.

Multiple requests with the same X-Forwarded-For header.

The IP was reported for attempting a DNS Amplification attack, exploiting vulnerabilities in domain name servers to turn initially small queries into much larger payloads.

The IP attempted a pass-the-hash attack, trying to authenticate without knowing the plaintext password.

This IP was caught circulating email worms, camouflaged as legitimate mails.

Made various attempts at a forged return-path attack, attempting to spoof their source email address.

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: request for a file often associated with an outdated version of Composer and phpunit used in a remote code execution attack.

It's observed that the IP operated a series of attacks exploiting insecure direct object references.

The IP attempted to perform SOAP Injection attacks on the Apache server.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

GET /db/finance.dump: An attempt to access a database dump file.

GET /modules/productpageadverts/uploadimage.php: This is related to a known vulnerability in the Prestashop module productpageadverts.

It was discovered using our server in an open relay configuration, sending emails from unauthorized domains.

Initiated a Zero-day attack, exploiting unknown vulnerabilities in our Mail and Postfix services.

Too Many Request Timeouts: An abnormal amount of request timeouts might suggest an ongoing Slowloris attack.

The IP made multiple unsuccessful login attempts to the SASL server in a short period of time.

Remote Execution Attempts: Logs showing unusual terminal commands or scripts run through web access.

The IP was traced back to stealthy installation attempts of clipboard monitors.

This IP belongs to Dropbox.