This IP belongs to United Technologies.

The IP address attempted to exploit known vulnerabilities in server software.

Our team flagged this IP for injecting harmful ActiveX codes.

The IP engaged in an HTTP Desync attack, misaligning HTTP request and responses to yield SSH vulnerability.

Initiated a Zero-day attack, exploiting unknown vulnerabilities in our Mail and Postfix services.

The IP was seen attempting a Dictionary attack on the FTP server, systematically entering every word in a dictionary as a password to find the correct one.

Multiple requests with the same Max-Forwards header.

The IP attempted to perform a phishing attack using the SASL server.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.

It made multiple requests with identical Accept-Charset headers.

It attempted to send emails from the Mail server that violate the server's acceptable use policy.

This IP was tracked while attempting to distribute secretive and malicious keyloggers.

Participated in malicious pranks by altering messages sent through the server.

It launched invasive malware to corrupt crucial segments of our server functionality.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

The IP attempted to perform a dictionary attack on the POP3 server.

It attempted to intercept SSL/TLS secured mail connections to eavesdrop or modify the passing data.

With the introduction of hidden malicious intent, this IP found to be operating masked redirect attacks.

The IP attempted to exploit known vulnerabilities in the SIP protocol.

It attempted to login to the Postfix server with an invalid password.

This IP attempted to disrupt our systems through the propagation of worms.

The IP attempted logins at unusual times.

POST /user/register: An attempt to register a new user or brute force the user registration form.

It launched Spoofing attacks, trying to hide its identity by disguising itself as a trusted user or server.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.