The IP attempted to perform SOAP Injection attacks on the Apache server.

It sought to exploit cross-site scripting (XSS) vulnerabilities within our mail service web interface.

It attempted to exploit known vulnerabilities in the Postfix software.

Multiple requests with the same DNT (Do Not Track) header.

This IP belongs to General Motors.

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: request for a file often associated with an outdated version of Composer and phpunit used in a remote code execution attack.

This IP belongs to Marathon Petroleum.

Repeated attempts to use the same password across multiple accounts.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

It initiated multiple account lockouts in a short period.

The IP had been flagged for initiating SYN flood attacks on our servers.

The IP attempted to perform Session Replay attacks on the Apache server.

The IP was involved in a FTP Injection attack, exploiting vulnerabilities in the FTP server to execute unauthorized commands.

The IP attempted to use the FTP server to distribute ransomware.

This IP gave off a red flag for hosting a hidden command and control server for malicious bots.

It attempted to use the FTP server to distribute web proxy tools.

This IP belongs to Reliance Jio.

An alarming frequency of microphone loggers has been traced back to this IP.

The IP attempted session sidejacking, seeking to take over SSH sessions post-authentication.

It attempted to use the FTP server to distribute web proxy tools.

This IP belongs to Netflix.

GET /internal/: Browsing an internal directory.

The IP made multiple unsuccessful login attempts to the IMAP server in a short period of time.

It attempted to send emails with deceptive subject lines from the Mail server.

This IP belongs to Best Buy.