This IP belongs to PepsiCo.

This IP belongs to Phillips 66.

This IP belongs to 3M.

POST /login.jsp?user=admin&pass=admin: This could be an attempt to log in as an admin.

It repeatedly attempted to run server-side injection attacks, trying to execute malicious code on our server.

It attempted to exploit known vulnerabilities in the Postfix software.

The IP was seen performing a CSRF (Cross-site request forgery) attack to manipulate user actions.

The IP attempted to send spam emails from the Mail server.

The IP was part of an IRC-Bot network, a type of botnet that uses the Internet Relay Chat (IRC) protocol.

It attempted to send emails from the Mail server that violate the server's usage policy.

An identity theft activity was linked back to this malicious IP.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

The IP's involvement in spreading password stealers has compromised our network's protection.

This IP belongs to Procter & Gamble.

The IP was seen launching a DDoS attack on the FTP server, overwhelming it with traffic to disrupt its normal functioning.

It systematically tried to exploit IMAP and POP3 vulnerabilities present in our mail service setup.

This IP was traced back to several attempts to access domain admin credentials.

High network traffic at unusual times, suggesting an automated process is running.

It attempted to send emails with malicious links from the Postfix server.

The IP was seen trying to perform a PASV FTP Bounce attack, misusing the passive mode to scan other hosts and ports.

Repeated attempts to perform actions that are typically restricted, such as creating or modifying user accounts.

The IP distributed unrequested software, secretly stealing user data while posing as useful tools.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

A sudden increase in the number of new user accounts, which can indicate an attacker has gained access and is creating backdoor accounts.

It attempted to perform a credential stuffing attack on the SSH server.