This IP was involved in a Remote File Inclusion (RFI) attack, exploiting a vulnerability to execute malicious scripts from a remote server.

The IP attempted to download sensitive files from the SSH server.

The IP attempted to perform a credential stuffing attack on the IMAP server.

It attempted to send emails from the Mail server that violate the server's email content policy.

The IP attempted to perform a dictionary attack on the IMAP server.

The IP attempted to send emails from the Postfix server that violate the server's terms of service.

This IP belongs to Phillips 66.

It attempted to send emails with deceptive subject lines from the Mail server.

It attempted to use a TearDrop attack to corrupt data packets being sent to our server.

This IP belongs to Berkshire Hathaway.

It made successive tries to alter SMTP relay configurations to send unsolicited emails.

Multiple requests with the same Max-Forwards header.

This IP belongs to Bank of America.

Server Misconfiguration Exploitation: Logs illustrating attempts at exploiting known server misconfigurations.

The IP attempted 'DLL Injection' to alter the server's behavior in a malicious manner.

The IP made multiple requests using uncommon HTTP methods.

This IP belongs to Medium.

The IP attempted to inject malicious scripts into the server hoping it would get executed.

The suspicious IP attempted to introduce spyware under the guise of software updates.

Distributed session hijackers from the IP were designed to capture and exploit web browser sessions.

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

Repeated attempts to access rarely used or hidden services on the server.

It attempted to use the FTP server to distribute SQL injection tools.

It attempted to use the VOIP server as a relay for calls to premium-rate numbers.