Multiple failed login attempts from the same IP address.

It attempted to use the SSH server as a proxy for other malicious activities.

Our system flagged this IP as conducting fraudulent transactions activities.

It attempted to perform a Quake Network Protocol amplification attack on the SSH server.

The IP attempted to implement a 'BlueKeep' exploit, leveraging protocol vulnerabilities to execute remote code through SSH network services.

By leveraging the AgeTunnel software, the IP attempted to establish a covert channel across the SSH session.

It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

https://winnita-promocode.com/

The IP attempted to perform Stack Overflow attacks on the Apache server.

The IP attempted to perform a password spraying attack on the SASL server.

The IP attempted various header manipulation attacks, aiming to bypass spam filters.

The IP attempted to perform a DNS amplification attack on the SSH server.

GET /internal/: Browsing an internal directory.

Multiple requests to the password reset page.

Unusual patterns in referrer URLs.

The IP attempted to use the SASL server to relay phishing emails.

This IP belongs to Plusnet.

It was making constant NDR (Non-Deliverable Receipt) or backscatter attacks by generating large amount of invalid email addresses.

It attempted zero-day attacks, exploiting unknown vulnerabilities in pop3.

This IP belongs to Procter & Gamble.

This IP belongs to Facebook.

This IP belongs to Telus Communications.

The said IP has been connected to attempts to distribute malicious shopping apps.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

The IP attempted to perform a Fraggle attack on the SSH server.