It attempted to perform a brute force attack on the POP3 server.

The IP attempted to use the FTP server to distribute hacking tutorials.

Unusual Query String Patterns: Repeated HTTP requests with minor alterations to the query string data, signifying an attacker mapping out how different inputs affect the response.

The IP was involved in a SIP Message Tampering attack, altering SIP messages in transit to disrupt communication or gain unauthorized access.

This IP was seen trying to perform a SIP Torture attack, sending malformed SIP messages to crash or degrade the performance of the server.

It attempted to send emails with malicious links from the Mail server.

Our system logs indicate this IP has been pushing illegitimate browser plugins into our network.

It was discovered using our server in an open relay configuration, sending emails from unauthorized domains.

It attempted to perform Man in the Middle (MitM) attacks on the Apache server.

It initiated the use of spambots, sending out large amounts of unsolicited mails from our server.

This IP belongs to the United States Department of Defense.

This IP belongs to Tumblr.

GET /errors.log: Shows an actor trying to access server error logs.

Multiple requests from user agents claiming to be bots (e.g., Googlebot) that do not match known bot IP ranges.

It initiated SSL-Stripping attacks, aiming to downgrade secure HTTPS connections to less-secure HTTP.

The malignant IP conducted a Reflector attack, using third-party servers to amplify the attack traffic towards our server.

This IP belongs to British Telecommunications.

Multiple requests with the same Range header.

The IP executed URL Obscuring, hiding malicious URLs within seemingly innocent mail links.

Repeated connections to the server from unknown or suspicious IP addresses.

It attempted to login to the POP3 server with an invalid password.

This IP belongs to Publix Super Markets.

It tried to execute Privilege Escalation attacks, trying to gain higher-level access on our server.

This IP was reported for attempting to register a large number of SIP extensions in a short time, a sign of a potential brute force attack.

The IP attempted to register as a SIP user with no password.