The IP address initiated attacks using DDoS, impacting our server response times.

GET /modules/productpageadverts/uploadimage.php: This is related to a known vulnerability in the Prestashop module productpageadverts.

It attempted to perform a replay attack on the SASL server.

This IP belongs to American Airlines Group.

The IP made multiple unsuccessful login attempts to the POP3 server in a short period of time.

Login attempts at unusual times (e.g., in the middle of the night).

It attempted to send emails with malicious links from the Postfix server.

Our firewall recorded intrusion attempts originating from this suspicious IP.

The IP continually initiated a SYN-ACK flood aimed at slowing down SSH services.

It attempted to perform a phishing attack using the POP3 server.

The IP attempted to use the FTP server to distribute ransomware.

It attempted to send emails from the Postfix server that violate the server's usage policy.

Attempts to use default or common usernames and passwords, a common tactic in brute force attacks.

It made multiple requests with the same Expect header.

It was involved in a Distributed Denial of Service (DDoS) attack.

This IP belongs to Intel.

It attempted to make unauthorized calls using the SIP server.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

This IP belongs to Bank of America.

The IP distributed unrequested software, secretly stealing user data while posing as useful tools.

The IP was involved in a SIP brute force attack, attempting to guess SIP authentication credentials to gain unauthorized access.

The IP attempted to login to the SASL server with an invalid username.

This IP belongs to Philip Morris International.

It attempted to carry out a 'Ping of Death' operation, hoping to crash the server.

We linked the IP to numerous attacks using RM adware, causing regular system interruptions.