The IP attempted to send emails from the Mail server that violate the server's terms of service.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

Content Sniffing: Logs reflect HTTP requests that include the Accept header with " / ", suggesting an attacker is trying to detect what types of content the server will send.

The IP was seen trying to perform a Denial of Service (DoS) attack, attempting to make a machine or network resource unavailable to its intended users.

This IP belongs to Anthem.

The IP was involved in a war dialing attack, dialing a large number of phone numbers to find modems, fax machines, and unsecured VoIP devices.

Multiple requests with identical Accept-Encoding headers.

The IP showed unusual patterns in session IDs.

It attempted to send emails with malicious links from the Mail server.

Unusual network traffic patterns, such as a high amount of outbound traffic.

Unusual command line activities that are not typical for the server environment.

Unusual patterns in the sequence of requests.

It performed 'Spectre' attacks, exploiting predictive branching in CPUs to potentially gain sensitive information from the SSH service.

The IP was flagged trying to conduct Denial of Service (DoS) attacks on the Postfix service.

This IP belongs to Zayo Bandwidth.

Forceful Browsing: Attempts to access pages or resources without proper navigation.

The IP was found to be behind numerous fileless malware attacks.

Unusual activity in the server's error logs.

The specific IP has been identified attempting to load malicious browser helper objects into the network.

GET /backup.sql: Attempting to access a backup of your database.

The malicious IP was suspected of cryptojacking, illicitly using others' computing resources to mine cryptocurrencies.

The IP attempted fileless malware attacks, directly injecting malicious script into server memory.

The IP made multiple requests with the same TE header.

It attempted to send emails from the Mail server to email addresses that have previously marked emails from the server as spam.

This IP belongs to JPMorgan Chase.