The IP attempted to use the Mail server to relay emails with malicious links to other servers.

It attempted to flood the SIP server with REGISTER requests.

It attempted to use the Postfix server to relay phishing emails to other servers.

This IP belongs to Nike.

It attempted to exploit known vulnerabilities in the POP3 protocol.

It attempted to perform a NTP amplification attack on the SSH server.

GET /ELMAH.axd: Attempting to exploit ELMAH (Error Logging Modules and Handlers) misconfiguration in ASP.NET sites.

System logs trace back the distribution of trojans that could allow for remote access to this suspicious IP.

The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

It attempted to use the IMAP server to relay spam.

Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

The IP was discovered trying Server Message Block relay attacks to gain unauthorized SSH access.

The IP set off alarms for an attempted man-in-the-middle attack on our servers.

It attempted to carry out a 'Ping of Death' operation, hoping to crash the server.

The IP attempted to gain unauthorized access to the Apache server.

The malicious IP was reported for sending a high volume of SIP INVITE requests, a potential sign of a call flooding attack.

The IP launched Ping Flood attacks as a detrimental strategy to overwhelm server resources.

Multiple failed login attempts using different usernames.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

The IP attempted to use the FTP server as a proxy for other malicious activities.

This IP belongs to Amazon.

GET /setup.php: Effort to locate setup files for PHP applications.

Attempts to access sensitive areas of the server, such as the admin page or user account information.

This IP belongs to Heroku.

This IP belongs to Telefonica Spain.