definately looks phishy

This IP belongs to Kroger.

It attempted to use the FTP server to store illegal content.

The IP was seen trying to perform a TDoS (Telephony Denial of Service) attack, flooding the VoIP server with calls to make it unavailable to users.

The malicious IP was reported for attempting a Session Teardown attack, sending BYE messages to end SIP sessions prematurely.

Multiple requests with identical Accept-Charset headers.

It attempted to use the SASL server to distribute malware.

Somthing smells phishy

It attempted to send emails with deceptive subject lines from the Postfix server.

The malicious IP was found trying to exploit the IMAP 'unselect' vulnerability.

It was involved in the operation of a REG-Bot, a type of bot that performs automated tasks.

This IP was responsible for circulating malicious images masked with spyware.

This IP was seen scanning for open ports and vulnerabilities, a common reconnaissance activity before launching attacks.

It attempted to perform a man-in-the-middle attack on the SSH server.

Weird loginz

Multiple attempts to access the server using encrypted tunnels or proxies.

The IP attempted to use the Mail server to relay emails with malicious links to other servers.

The IP was marked trying to carry out Backscatter spam by replying to spam using the server's configuration.

Login attempts using old or outdated protocols.

This IP belongs to AT&T.

The malicious IP attempted to gain unauthorized access to the server by repeatedly trying different username and password combinations.

The IP address attempted to exploit known vulnerabilities in server software.

The malicious IP attempted to gain unauthorized access to the server by repeatedly trying different username and password combinations.

POST /login.jsp?user=admin&pass=admin: This could be an attempt to log in as an admin.

The IP attempted to register as an Asterisk user with no password.