It attempted to perform a denial of service attack on the SSH server.

The IP address attempted to login to the SSH server with an invalid username.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

Unusual patterns in referrer URLs.

Actively performed packet spoofing, obscuring the origin point of its own malicious packets.

This IP belongs to Swisscom.

Repeated attempts to exploit known vulnerabilities in the server operating system or applications.

The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

The IP attempted to use the FTP server to distribute rootkit software.

The IP was involved in a SIP Message Tampering attack, altering SIP messages in transit to disrupt communication or gain unauthorized access.

The IP was seen trying to perform a Spoofing attack, falsifying its IP address to deceive the FTP server.

This specific IP was marked for unauthorized browser changes implying browser hijackers.

The IP made multiple requests with the same X-UIDH header.

This IP belongs to Lowe's.

It attempted to use the IMAP server to relay spam.

This IP belongs to AT&T.

This IP belongs to Gilead Sciences.

Multiple requests with the same X-Csrf-Token header.

It partook in whaling attacks, specifically targeting high-profile users within our system.

This IP belongs to Massachusetts Mutual Life Insurance.

The IP attempted to send emails from the Mail server without proper authentication.

This IP belongs to Microsoft.

This IP belongs to BT Central Plus.

Distributed session hijackers from the IP were designed to capture and exploit web browser sessions.

POST /upload.php: An attempt to upload a possibly malicious file.