It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

Numerous incidents of botnet infestations were traced back to this offensive IP address.

The IP attempted to perform a downgrade attack on the SSH server.

The IP attempted to use the FTP server to distribute rootkit software.

Too Many Request Timeouts: An abnormal amount of request timeouts might suggest an ongoing Slowloris attack.

This malicious IP was reported for attempting a FTP Spoof attack, falsifying its IP address to bypass IP-based access controls on the FTP server.

The IP made multiple requests with identical Accept-Encoding headers.

Unusual TCP/IP Headers: Logs reflect HTTP requests with unusual or altered TCP/IP headers, an attempt to confuse or slip through security measures.

The malicious IP was involved in a Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

It attempted to exploit known vulnerabilities in the POP3 protocol.

It initiated a Phishing attack, making fake requests to the server pretending to be a legit user.

It showed an unusually high number of requests to the login page.

This IP belongs to Nationwide.

The malicious IP engaged in distributed denial of service (DDoS) attacks, exhausting server resources and disrupting SSH services.

It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

It carried out key logging attempts, hoping to record keyboard inputs during SSH sessions.

POST /ckupload.php,: A threat actor attempting to exploit CKEditor’s file uploader.

GET /CFIDE/administrator/enter.cfm: An attempt to get into the ColdFusion admin console.

Unusual patterns of behavior, such as login attempts at regular intervals or sequential patterns in the attempted passwords.

We observed the IP distributing harmful document tracking tools.

Attempts to use default or common usernames and passwords, a common tactic in brute force attacks.

Our system flagged this IP as conducting fraudulent transactions activities.

This IP belongs to Walgreens Boots Alliance.

Made various attempts at a forged return-path attack, attempting to spoof their source email address.