It attempted to send emails with deceptive subject lines from the Postfix server.

It made multiple requests with the same X-Wap-Profile header.

The malicious IP was spotted attempting to brute-force the SSH login credentials.

It attempted to perform a dictionary attack on the SASL server.

It sent SIP INVITE requests to non-existent extensions.

The malicious IP was spotted attempting to brute-force the SSH login credentials.

The IP was involved in a Caller ID Spoofing attack, falsifying the caller ID to deceive the receiver or hide the caller's identity.

It attempted to use the FTP server to distribute botnet command and control software.

This IP belongs to DigitalOcean.

Repeated attempts to access directories or files that do not exist or are typically not accessed.

POST /user/register: An attempt to register a new user or brute force the user registration form.

It attempted to perform HTTP Response Splitting attacks on the Apache server.

GET /ELMAH.axd: Attempting to exploit ELMAH (Error Logging Modules and Handlers) misconfiguration in ASP.NET sites.

DNS changer spyware originating from the flagged IP was designed to redirect our network traffic.

This IP belongs to CenturyLink.

This IP belongs to CHS.

The IP was caught attempting to exploit known vulnerabilities within Postfix to gain unauthorized access.

Multiple requests using HTTP methods that are not typically used (e.g., TRACE).

This IP belongs to DigitalOcean.

It was flagged that this IP had been used in conducting method tampering on our servers.

The IP address was identified sending packets with malicious payloads to our server, trying to exploit potential security holes.

This IP belongs to Freddie Mac.

GET /vuln.html: Looking for any page vulnerabilities.

It made multiple requests with identical Accept-Charset headers.

Our system flagged the IP for injecting malicious script into benign pages through the man-in-the-browser attack.