It tried to execute dictionary attacks on our Mail service causing potential delays.

It attempted to perform Race Condition attacks on the Apache server.

The IP attempted to send emails from the Postfix server to blacklisted email addresses.

The IP attempted to register with the Asterisk server using an invalid username.

The IP was seen trying to perform a Spoofing attack, falsifying its IP address to deceive the FTP server.

This particular IP has been used in advanced persistent threats against our servers.

It made multiple requests with the same X-Att-Deviceid header.

HTTP Fingerprinting: Sequential requests that aim to identify server software types and version numbers.

It attempted to perform a Land attack on the SSH server.

The IP was seen trying to exploit known vulnerabilities in server software, a common tactic for gaining unauthorized access or control.

The IP was seen launching a DDoS attack on the FTP server, overwhelming it with traffic to disrupt its normal functioning.

It attempted to perform a side channel attack on the SSH server.

Attempts to access the server using unusual HTTP methods or request types.

The IP tried to manipulate DNS lookup processes to divert traffic to a malicious destination.

It sought to exploit cross-site scripting (XSS) vulnerabilities within our mail service web interface.

The IP was seen trying to upload files to the FTP server, possibly with the intent of distributing malware.

Path/File Enumeration: Logs show multiple HTTP requests to non-existing pages and incrementing filenames, suggesting file or path enumeration.

This IP belongs to CVS Health.

This IP belongs to Kraft Heinz.

The IP attempted to perform Remote File Inclusion (RFI) attacks on the Apache server.

Multiple account lockouts in a short period of time.

Repeated attempts to access rarely used or hidden services on the server.

The IP attempted a pass-the-hash attack, trying to authenticate without knowing the plaintext password.

It's observed that the IP operated a series of attacks exploiting insecure direct object references.

The IP attempted to download emails from the POP3 server without authorization.