This IP belongs to CHS.

It made multiple attempts to initiate malicious File Transfer Protocol (FTP) sessions with the Postfix service.

The IP made repeated attempts to authenticate with the SIP server using different usernames.

Unusual network traffic patterns, such as a high amount of outbound traffic.

Multiple requests with identical POST parameters.

Too Many Request Timeouts: An abnormal amount of request timeouts might suggest an ongoing Slowloris attack.

The malicious IP was involved in a credential stuffing attack, using stolen username-password combinations to gain unauthorized access.

Inclusion of Binary Data in HTTP Request: If binary data is included in the HTTP request, this could suggest an attacker is attempting a binary exploit.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

The IP attempted to send emails from the Postfix server that violate the server's terms of service.

Multiple requests with the same Expect header.

HTTP Request with Odd Timing: Very precisely timed HTTP requests could imply an automated tool or bot.

Attempts to access the server using outdated or insecure protocols, which can indicate an attacker is trying to exploit known vulnerabilities.

The IP was seen trying to perform a call transfer to an external number, a potential sign of toll fraud.

The IP attempted to use the Mail server to relay emails with misleading headers to other servers.

It attempted to delete directories on the FTP server.

This IP belongs to Cisco Systems.

This IP made wrongful manipulations indicating the operation of malicious downgrader.

The IP attempted to download emails from the POP3 server without authorization.

It made various efforts to insert spyware to monitor SSH communications covertly.

Numerous incidents of botnet infestations were traced back to this offensive IP address.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

This IP belongs to Canadian Department of Defense.

It tried to execute dictionary attacks on our Mail service causing potential delays.

Inclusion of Binary Data in HTTP Request: If binary data is included in the HTTP request, this could suggest an attacker is attempting a binary exploit.