It attempted to perform a Chargen amplification attack on the SSH server.

The IP made multiple unsuccessful login attempts to the SASL server in a short period of time.

The IP attempted to send emails from the Postfix server that violate the server's terms of service.

It launched SQL injection attempts, to break our server database through poorly secured entry fields.

Login attempts that do not follow typical user behavior patterns.

The IP tried to crack S/MIME encryption for accessing secured email contents.

This IP was traced back to several attempts to access domain admin credentials.

IP Spoofing: Logs showing HTTP requests with IP ranges that are typically reserved for private networks or an unusual X-Forwarded-For header.

This IP belongs to Microsoft.

GET //web-console/Invoker: Might be an attempt to access JBoss server's web console for exploitation.

A multitude of spyware-infected download wrappers were linked to the spotted IP address.

It attempted to send emails from the Mail server that violate the server's acceptable use policy.

The IP attempted to send emails from the Mail server without proper authentication.

Attempted to conduct numerous data harvesting strategies to gather sensitive user data.

This IP belongs to Ziggo.

Participated in malicious pranks by altering messages sent through the server.

POST /ckupload.php,: A threat actor attempting to exploit CKEditor’s file uploader.

It tried to force its way into a secure admin session by trying to hijack the session's cookies.

The IP was seen trying to change the configuration settings of the Asterisk server, potentially to disable security features.

The IP was involved in a phishing attack, creating a fake webpage to deceive users into providing their sensitive personal or financial information.

This IP was traced back to several attempts to access domain admin credentials.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

Identification of Known Vulnerabilities: Attempts to exploit known vulnerabilities related to your server application.

The IP partook in Drive-by attacks, embedding malicious scripts on benign websites.

This IP belongs to TJX.