The IP was involved in a FTP Spam attack, using the FTP server to distribute unsolicited emails or messages.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

This IP belongs to Swisscom.

It attempted to use the SASL server to distribute malware.

It attempted to perform a man-in-the-middle attack on the POP3 server.

By launching ApacheKiller attacks, the IP aimed to cause a Denial of Service by exhausting memory resources.

This IP belongs to Walgreens Boots Alliance.

HEAD /: May be part of a larger Reconnaissance.

It made various efforts to insert spyware to monitor SSH communications covertly.

The IP attempted to bypass the SASL server's authentication mechanism.

The malicious IP was identified trying to leverage the Postfix service to send bulk spam emails.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

The suspicious IP attempted to introduce spyware under the guise of software updates.

Connection Timeout Abuse: Logs illustrating excessive requests that aim to use up server connections.

This IP belongs to New York Life Insurance.

It attempted to use the Postfix server to relay malware-infected attachments to other servers.

It attempted to make unauthorized calls using the Asterisk server.

Multiple requests with the same X-Wap-Profile header.

Multiple requests with the same X-Wap-Profile header.

This IP belongs to AmerisourceBergen.

It actively sought to exploit unpatched software within our server applications.

The IP attempted to send emails from the Mail server without proper authentication.

This IP belongs to Procter & Gamble.

This IP belongs to Home Depot.

Probing for Hidden Files: HTTP requests for files that should not be publicly accessible could suggest an attacker probing for unsecured content.