It attempted to send emails with deceptive subject lines from the Postfix server.

The IP was observed participating in Social Engineering attacks to manipulate individuals into revealing SSH login details.

Initiated rogue DHCP server set up, attempting to disrupt our network and intercept emails.

It attempted to perform a Smurf attack on the SSH server.

This IP belongs to Fannie Mae.

The IP was involved in a brute force attack on the FTP server, systematically guessing usernames and passwords to gain unauthorized access.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

The IP attempted to perform a VOIP Hopper scan on the VOIP server.

POST /WebResource.axd: Attempting to exploit a known .NET vulnerability.

This IP belongs to Citigroup.

This IP belongs to Cloudfare.

It attempted to change file permissions on the FTP server.

It attempted to send emails from the Mail server that violate the server's usage policy.

It attempted to perform a Teardrop attack on the SSH server.

The IP showed unusual patterns in session IDs.

It made multiple requests from user agents claiming to be bots.

The malicious IP initiated numerous HTTP flood attacks, designed to overwhelm the Apache server with requests.

The IP was recorded making persistent attempts to crack our encryption.

The IP partook in Drive-by attacks, embedding malicious scripts on benign websites.

The IP was involved in a SIP brute force attack, attempting to guess SIP authentication credentials to gain unauthorized access.

This IP belongs to Phillips 66.

POST /login.jsp?user=admin&pass=admin: This could be an attempt to log in as an admin.

It attempted to exploit known vulnerabilities in the Mail protocol.

It attempted to take advantage of misconfigurations in the Apache server.

It attempted to perform a brute force attack on the POP3 server.