Frequent password reset requests.

The IP initiated a man-in-the-middle (MitM) attack, attempting to capture sensitive information during legitimate email exchange.

This IP belongs to Cardinal Health.

It initiated a Phishing attack, making fake requests to the server pretending to be a legit user.

Several cross-site scripting attacks were traced back to this IP.

The IP attempted to implement a 'BlueKeep' exploit, leveraging protocol vulnerabilities to execute remote code through SSH network services.

The IP attempted to perform a distributed denial of service attack on the SSH server.

The IP attempted a DLL injection attack, hoping to execute malicious code within our SSH processes.

The IP attempted to use the POP3 server to distribute malware.

It attempted to exploit known vulnerabilities in the POP3 protocol.

This IP belongs to Xbox Live.

This IP belongs to Shaw Communications.

An identity theft activity was linked back to this malicious IP.

Several cross-site scripting attacks were traced back to this IP.

This IP belongs to Dreamhost.

This IP belongs to Philip Morris International.

Unusually high number of requests to a specific service or application within the server.

The IP made multiple requests with the same X-UIDH header.

Multiple attempts to access the server using anonymous or generic user accounts.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

This IP has been marked as the origin of numerous SQL injection attacks.

Multiple requests with the same X-Att-Deviceid header.

The IP attempted to send emails from the Mail server that violate the server's terms of service.

The IP attempted to register as an Asterisk user with no password.

It attempted to send emails from the Mail server that violate the server's usage policy.