It initiated a Phishing attack, making fake requests to the server pretending to be a legit user.

The IP sent numerous Asterisk OPTIONS requests in a short time.

It attempted to send emails with malicious links from the Mail server.

Attempts to login using a sequential list of passwords, indicating a possible brute force attack.

This malicious IP was reported for trying to exploit known vulnerabilities in the FTP server software, potentially to gain control over the server.

Multiple failed attempts to use the server’s API.

It attempted to perform a Smurf attack on the SSH server.

It attempted to send emails from the POP3 server without authorization.

GET /errors.log: Shows an actor trying to access server error logs.

It attempted to delete emails from the POP3 server without authorization.

GET /admin: Looking for an unprotected admin page.

This IP belongs to Boeing.

The IP attempted to create new directories on the FTP server.

The IP actively participated in snowshoe spamming, spreading its spam output across many IPs and domains to avoid detection.

This IP belongs to the University of California, Berkeley.

It conducted Rainbow table attacks, which use precomputed tables for reversing hash functions.

This IP was detected distributing spyware-infected USB drives to our users.

It attempted to use the Postfix server to relay spam to other servers.

Path/File Enumeration: Logs show multiple HTTP requests to non-existing pages and incrementing filenames, suggesting file or path enumeration.

It executed directory traversal attempts to access unauthorized directories / folders in our server.

This IP belongs to Cloudfare.

This IP belongs to Heroku.

The IP was found to be behind numerous fileless malware attacks.

Multiple failed login attempts using different usernames.

This IP belongs to OVH.