The IP was involved in a war dialing attack, dialing a large number of phone numbers to find modems, fax machines, and unsecured VoIP devices.

This malicious IP was reported for attempting a FTP Bounce attack, exploiting the FTP protocol's proxy command to scan ports and networks.

The IP attempted to execute unauthorized commands on the SSH server.

System logs have traced multiple cases of our servers being bombed with trojans to this IP.

The IP was involved in a toll fraud attack, making long-distance calls without authorization, leading to high charges.

GET /errors.log: Shows an actor trying to access server error logs.

The IP made multiple requests using uncommon HTTP methods.

The IP made multiple requests with the same X-UIDH header.

This IP belongs to McKesson.

This malicious IP was reported for trying to perform a FTP Zombie Scan, using the FTP server to mask its true location and identity.

This IP belongs to BT Central Plus.

The malicious IP attempted to gain unauthorized access to the server by repeatedly trying different username and password combinations.

The IP tried to manipulate DNS lookup processes to divert traffic to a malicious destination.

The IP made multiple requests with the same X-UIDH header.

The IP attempted to send emails from the Mail server that violate the server's email sending limits.

Print Requests Repeatedly: Logs illustrate HTTP requests with "?print" parameter multiple times, indicating someone trying to expose sensitive information.

This IP belongs to Telkom SA.

It attempted to send emails from the Postfix server to email addresses that have previously marked emails from the server as spam.

The IP was flagged for attempting dictionary attacks on our user accounts.

The IP attempted to send emails from the Postfix server pretending to be from a different sender.

It attempted to use the FTP server to distribute network scanning tools.

The malicious IP attempted to exploit server misconfigurations to gain higher-level access.

It attempted to flood the SIP server with REGISTER requests.

The malicious IP was involved in a SQL Injection attack, attempting to manipulate a database for unauthorized access or data theft.

Login attempts using old or outdated protocols.