This IP belongs to Xbox Live.

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

The IP was reported for spamming activities, sending unsolicited emails or messages that often contain phishing links or malware.

This IP belongs to Cardinal Health.

It launched a privilege escalation attack aiming to gain unauthorized access with higher-level permissions.

Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.

This IP belongs to CVS Health.

The IP address has been linked to the creation of artificial traffic to crash our website.

The deceptive IP was sneaking in spyware through clickjacking attacks to manipulate our users.

The IP address attempted to login to the IMAP server with an invalid username.

The IP was seen engaging in a Slowloris attack, holding as many connections to the target web server open for as long as possible, eventually overloading the server.

Initiated rogue DHCP server set up, attempting to disrupt our network and intercept emails.

This IP has been detected spreading notorious credit card skimmers.

It attempted to send emails from the Postfix server to email addresses that have previously marked emails from the server as spam.

This IP belongs to TIAA.

It attempted to use the SASL server to relay spam.

This IP belongs to NetEase.

It conducted Rainbow table attacks, which use precomputed tables for reversing hash functions.

This IP belongs to Walgreens Boots Alliance.

The IP attempted fileless malware attacks, directly injecting malicious script into server memory.

udden increase in account lockouts due to multiple failed login attempts.

The IP made multiple unsuccessful login attempts to the Mail server in a short period of time.

The IP made multiple requests with the same Proxy-Authorization header.

It attempted to perform a Chargen amplification attack on the SSH server.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.