The malicious IP was reported for attempting a SIP Ping attack, sending SIP OPTIONS messages to discover SIP servers or users.

The IP attempted to perform Symlink attacks on the Apache server.

It attempted to perform Uncontrolled Format String attacks on the Apache server.

The IP tried to manipulate DNS lookup processes to divert traffic to a malicious destination.

The IP has been traced back to system monitors, aiming to watch and record user activity.

It was flagged initiating reflective (DRDoS) attacks, intending to exhaust our server resources.

This malicious IP was reported for trying to perform a Man-in-the-Middle attack, intercepting and potentially altering communication between the FTP server and its clients.

It attempted to send emails from the Mail server that violate the server's acceptable use policy.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

It attempted to carry out a dictionary attack on pop3 logins to gain unauthorized access.

This IP belongs to DuPont de Nemours.

It attempted to use the Postfix server to relay spam to other servers.

The IP attempted to perform a password spraying attack on the SASL server.

The IP was identified as operating a Registration Bot (REG-Bot), automating the creation of multiple fake accounts on various platforms.

It launched SQL injection attempts, to break our server database through poorly secured entry fields.

The IP attempted to use the Mail server to relay spam to other servers.

It was discovered using our server in an open relay configuration, sending emails from unauthorized domains.

Repeated failed attempts to perform actions that require higher privileges.

The IP made multiple unsuccessful login attempts to the SSH server in a short period of time.

The IP made multiple requests with the same Via header.

The IP address attempted to login to the FTP server with an invalid username.

The malicious IP was reported for attempting a SIP Proxy attack, using a SIP server to mask its true location and identity.

This IP belongs to World Fuel Services.

This IP was detected initiating zero-day exploit attacks on our system.

The IP exhibited unusual patterns in the Accept-Language header.