This IP belongs to TELUS Communications.

It attempted to use the Asterisk server as a relay for calls to premium-rate numbers.

It attempted to use the FTP server to distribute botnet command and control software.

This IP belongs to Time Warner Cable Internet.

The IP attempted to delete directories on the SSH server.

This IP belongs to United Technologies.

It attempted to send emails from the Postfix server to email addresses that have previously marked emails from the server as spam.

A dangerous data surveillance spyware was tied back to this IP.

This malicious IP was seen sending unusually high volumes of requests, a sign of potential automated bot activity.

This malicious IP attempted a brute force attack, trying to crack login credentials to gain unauthorized access to a system or account.

The IP was involved in a Caller ID Spoofing attack, falsifying the caller ID to deceive the receiver or hide the caller's identity.

Multiple requests with identical Accept-Encoding headers.

This IP had been flagged for attempting to manipulate server behaviour by injecting shellcodes.

It attempted to exploit known vulnerabilities in the Postfix software.

The malicious IP was reported for attempting a Session Teardown attack, sending BYE messages to end SIP sessions prematurely.

The IP tried to execute Malware/Ransomware attacks via mail attachments.

Multiple failed login attempts using different usernames.

This IP belongs to CenturyLink.

It attempted to delete emails from the POP3 server without authorization.

This IP belongs to Honeywell International.

It tried to execute dictionary attacks on our Mail service causing potential delays.

It attempted to perform Local File Inclusion (LFI) attacks on the Apache server.

The IP executed URL Obscuring, hiding malicious URLs within seemingly innocent mail links.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

Repeated failed attempts to access application interfaces or ports that are typically not open to the public.