The IP attempted to perform a QOTD amplification attack on the SSH server.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

The IP made multiple requests with the same Proxy-Connection header.

It attempted to send emails from the Postfix server to email addresses that have previously marked emails from the server as spam.

This IP belongs to Archer-Daniels-Midland.

The IP attempted to perform a SNMP amplification attack on the SSH server.

The IP attempted to perform a timing attack on the SSH server.

It attempted to perform a dictionary attack on the SASL server.

This IP belongs to PepsiCo.

Participated in malicious pranks by altering messages sent through the server.

Attempts to access the server using credentials that have been involved in previous security incidents.

The IP attempted to mark emails as read on the IMAP server without authorization.

It attempted to perform Session Sidejacking attacks on the Apache server.

The IP sent numerous VOIP OPTIONS requests in a short time.

It attempted to perform a man-in-the-middle attack on the IMAP server.

The malicious IP was found to be running an Internet Relay Chat (IRC) bot, potentially spreading malware or launching Distributed Denial-of-Service (DDoS) attacks.

A multitude of spyware-infected download wrappers were linked to the spotted IP address.

POST /db/images/: Attempt to post or insert a malicious file in the images directory of a database.

POST /ckupload.php,: A threat actor attempting to exploit CKEditor’s file uploader.

It attempted to perform a Sentinels amplification attack on the SSH server.

This malicious IP was reported for attempting to perform a FTP Format String attack, exploiting format string vulnerabilities to crash the FTP server or execute arbitrary code.

This malicious IP was reported for trying to intercept VoIP calls, a type of eavesdropping attack aimed at capturing sensitive information.

POST /xmlrpc.php: Could indicate an attempt at exploiting the WordPress xmlrpc.php file, often used for brute forcing.

Our system logs indicate this IP has been pushing illegitimate browser plugins into our network.

The IP sent malformed Asterisk requests, potentially indicating an attempt to crash the server.