The IP made multiple unsuccessful login attempts to the SASL server in a short period of time.

The IP attempted to send emails with misleading headers from the Mail server.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

The IP was noticed spreading RATs (remote administration tools) camouflaged as regular software.

Multiple requests with the same Expect header.

It tried to create buffer overflows by sending large amounts of data at once to overwhelm server resources.

This IP belongs to Abbott Laboratories.

It made multiple requests with the same X-Requested-With header.

Unusual TCP/IP Headers: Logs reflect HTTP requests with unusual or altered TCP/IP headers, an attempt to confuse or slip through security measures.

It started header injection or email injection attempts, by adding extra data into the headers and confusing the server processes.

The IP attempted to register as a SIP user with no password.

Tried to perform a man-in-the-middle attack to intercept and alter communication between the server and clients.

This IP belongs to Optus.

This IP belongs to Best Buy.

It attempted to perform XML Entity Expansion attacks on the Apache server.

The IP address attempted to exploit known vulnerabilities in the Apache server software.

The IP attempted to send malware-infected attachments from the Postfix server.

This IP belongs to Kroger.

This IP belongs to Microsoft.

It partook in location spoofing, making it appear from different locations.

The IP under scrutiny has been associated with multiple modem hijackers.

GET /etc/passwd: An attempt to retrieve Linux server user account details.

This IP belongs to Bank of America.

A large number of requests from a single user agent, suggesting an automated process.

The IP attempted to send emails from the Mail server without proper authentication.