This IP belongs to Amazon.

This IP belongs to T-Mobile.

This IP belongs to United Technologies.

The IP made multiple unsuccessful login attempts to the SASL server in a short period of time.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

GET /errors.log: Shows an actor trying to access server error logs.

GET /setup.php: Effort to locate setup files for PHP applications.

It attempted to carry out a 'Ping of Death' operation, hoping to crash the server.

It appears this IP was linked to a number of drive-by-download attacks, silently downloading spyware.

This IP was seen trying to perform a RTP Injection attack, inserting audio into an established VoIP call.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

The IP attempted Forceful Browsing, trying to discover hidden directories or files which could contain SSH access data.

It performed 'Spectre' attacks, exploiting predictive branching in CPUs to potentially gain sensitive information from the SSH service.

The IP address has been associated with unwanted browser toolbar installations.

It was found that the IP has been exploiting zero-day vulnerabilities in our system.

This IP belongs to Verizon Communications.

It initiated SSL-Stripping attacks, aiming to downgrade secure HTTPS connections to less-secure HTTP.

The IP attempted to perform Symlink attacks on the Apache server.

The IP conducted exhaustive dictionary attacks, trying to guess password and username combinations.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

Multiple requests with the same Range header.

The IP attempted to perform Stack Overflow attacks on the Apache server.

GET /backup.sql: Attempting to access a backup of your database.

It attempted to use the Postfix server to relay emails with misleading headers to other servers.

The IP attempted to perform a replay attack on the SSH server.