It attempted to send emails from the Mail server that violate the server's email content policy.

This IP belongs to Amazon.

GET //web-console/Invoker: Might be an attempt to access JBoss server's web console for exploitation.

Login attempts from foreign IP addresses.

Unexpected changes in the server configuration or installed software.

Suspicious Http Referrer Field: HTTP requests with external referrer headers that usually originate from internal source.

It attempted to send emails from the Mail server to email addresses that have previously marked emails from the server as spam.

It attempted to exploit known vulnerabilities in the IMAP protocol.

The IP made multiple requests with the same X-UIDH header.

The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

It engaged in mail bombing, flooding the server with large amounts of insignificant mails.

The reported IP was identified as a BadBot, engaging in harmful activities such as unauthorized web scraping and data mining.

This IP belongs to Pfizer.

The IP attempted to use the FTP server to distribute keylogging software.

This IP belongs to Telefonica Spain.

The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

This IP belongs to Telefonica Spain.

The IP performed regular system foot printing to gain intel on weak points in our server.

This IP belongs to PepsiCo.

Our logs indicated an unusually high traffic volume originating from this IP address.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

It attempted to perform a man-in-the-middle attack on the SSH server.

This IP belongs to TIAA.

The malicious IP was found to be running an Internet Relay Chat (IRC) bot, potentially spreading malware or launching Distributed Denial-of-Service (DDoS) attacks.

This IP made wrongful manipulations indicating the operation of malicious downgrader.