The IP made multiple requests with the same Proxy-Authorization header.

This IP belongs to Target.

It attempted to use the POP3 server to relay phishing emails.

This IP was involved in a Remote File Inclusion (RFI) attack, exploiting a vulnerability to execute malicious scripts from a remote server.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

The malicious IP was identified trying to leverage the Postfix service to send bulk spam emails.

The IP attempted to upload malicious files to the FTP server.

This IP attempted to disrupt our systems through the propagation of worms.

POST /WebResource.axd: Attempting to exploit a known .NET vulnerability.

Multiple requests to the password reset page.

It engaged in mail bombing, flooding the server with large amounts of insignificant mails.

Multiple failed login attempts using different usernames.

This IP belongs to United Continental Holdings.

It made multiple requests with identical POST parameters.

GET /errors.log: Shows an actor trying to access server error logs.

The IP attempted Forceful Browsing, trying to discover hidden directories or files which could contain SSH access data.

It showed unusual activity in the server's error logs.

The IP attempted to perform Integer Overflow attacks on the Apache server.

Attempts to access sensitive areas of the server, such as the admin page or user account information.

The IP attempted to send emails from the Mail server pretending to be from a different sender.

It sent unusually large Asterisk packets, potentially indicating a buffer overflow attempt.

The IP attempted to perform a SNMP amplification attack on the SSH server.

It was found that the IP had deployed rogue security software in our system.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.

This IP belongs to Steam.