We flagged down attempts from the IP to leak backdoor viruses into the system.

The malicious IP was seen trying to perform a Replay attack, capturing SIP authentication data and resending it to gain unauthorized access.

Attempts to access the server using outdated or insecure protocols, which can indicate an attacker is trying to exploit known vulnerabilities.

It attempted to use the Postfix server to relay emails with malicious links to other servers.

The IP attempted reconnaissance activities, trying to footprint our server’s network.

This IP belongs to Cloudfare.

Unusual patterns in the sequence of requests.

The IP sent numerous SIP OPTIONS requests in a short time.

We linked the IP to numerous attacks using RM adware, causing regular system interruptions.

The IP attempted to perform a password spraying attack on the SASL server.

It exploited CVE-specific server vulnerabilities as a backdoor entrance to our mail system.

It exploited insecure server configurations and attempted to establish reverse SSH tunneling.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

Incidents of privacy-invasive software floating in our network were linked to this IP.

The IP tried to crack S/MIME encryption for accessing secured email contents.

It made multiple requests with identical Accept-Charset headers.

It established numerous 'doppelganger' domains to mimic our SSH server, aiming to trick users into revealing sensitive data.

It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

It appears that this IP was initiating DNSChanger malware attacks on our network.

It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

The IP attempted to perform a password spraying attack on the SASL server.

It continually sought to exploit known vulnerabilities within SSH through crafted packet attempts.

It utilized a Directory Harvest Attack, attempting to find valid e-mail addresses through guesswork.

The IP attempted to send emails from the IMAP server without authorization.

It attempted to perform Local File Inclusion (LFI) attacks on the Apache server.