The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

The IP was seen trying to perform a Denial of Service (DoS) attack, attempting to make a machine or network resource unavailable to its intended users.

The IP address attempted to register as a SIP user with an invalid username.

The IP attempted to perform a replay attack on the IMAP server.

It made multiple attempts to initiate malicious File Transfer Protocol (FTP) sessions with the Postfix service.

The IP was involved in a DDoS attack, sending massive amounts of traffic to overwhelm a server and disrupt its normal functioning.

The IP was recorded making persistent attempts to crack our encryption.

It initiated 'HOIC' (High Orbit Ion Cannon) to overload our Apache service with junk data.

This IP belongs to Vodafone.

The IP tried to launch 'Dark Tequila' malware that steals banking information and login credentials from the server.

Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

This IP belongs to American Express.

The deceptive IP was sneaking in spyware through clickjacking attacks to manipulate our users.

POST /modules/raptor_file_manager/upload.php: Attempt to use a known flaw in the Raptor file manager for arbitrary file upload.

Identification of Known Vulnerabilities: Attempts to exploit known vulnerabilities related to your server application.

This IP belongs to Walgreens Boots Alliance.

The IP showed unusual patterns in session IDs.

The malicious IP was identified trying to leverage the Postfix service to send bulk spam emails.

Forceful Browsing: Attempts to access pages or resources without proper navigation.

It attempted to perform a SIP Invite Flood on the VOIP server.

The IP address attempted to exploit known vulnerabilities in server software.

This IP belongs to T-Mobile.

The IP showed unusual patterns in referrer URLs.

This IP has been identified as running a botnet targeting our server systems with ransomware.

The IP attempted to send emails from the Postfix server pretending to be from a different sender.