This IP belongs to KDDI.

It attempted to create new directories on the SSH server.

The IP executed URL Obscuring, hiding malicious URLs within seemingly innocent mail links.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

The IP attempted to use the FTP server to distribute steganography tools.

It attempted to send emails from the Mail server that violate the server's acceptable use policy.

It attempted to perform a SIP Register Flood on the SIP server.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

The malicious IP initiated unauthorized Mail Queue access attempts, impacting mail service efficiency.

This IP belongs to United Technologies.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

Repeated attempts to access the server using old or outdated software versions, which might have known vulnerabilities.

It attempted to perform a NTP amplification attack on the SSH server.

It tried to execute dictionary attacks on our Mail service causing potential delays.

Unusually high CPU usage, which can indicate a brute force attack is in progress.

It attempted to use the VOIP server as a relay for calls to premium-rate numbers.

This IP belongs to DuPont de Nemours.

The IP attempted Forceful Browsing, trying to discover hidden directories or files which could contain SSH access data.

The IP attempted to send malware-infected attachments from the Mail server.

Repeated HTTP requests with error codes, indicating failed attempts to access restricted areas.

It initiated 'HOIC' (High Orbit Ion Cannon) to overload our Apache service with junk data.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

The IP attempted to use the Mail server to relay malware-infected attachments to other servers.

This IP belongs to Bell Canada.