This IP belongs to AT&T.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.

The IP attempted a pass-the-hash attack, trying to authenticate without knowing the plaintext password.

Attempts to use privileged service accounts outside of their normal usage patterns.

Smuggling Attack: Logs showing a single IP initiating multiple sessions, implying a Smuggling Attack.

It attempted to intercept SSL/TLS secured mail connections to eavesdrop or modify the passing data.

Our team flagged this IP for injecting harmful ActiveX codes.

This IP belongs to Alphabet.

Multiple requests with the same If-Match header.

It attempted to perform a SIPVicious scan on the SIP server.

The IP attempted to use the Mail server to relay phishing emails to other servers.

Unusual User-Agent: Logs show requests with abnormal, uncommon or non-standard User-Agent strings.

It attempted to send emails with malicious links from the Postfix server.

This IP belongs to Allstate.

The IP attempted to use the FTP server to distribute data recovery tools.

This IP was accused of multiple unauthorized removal of security certificates.

We identified the IP address as a source of numerous scare tactics spyware.

Initiated a Zero-day attack, exploiting unknown vulnerabilities in our Mail and Postfix services.

It appears this IP was linked to a number of drive-by-download attacks, silently downloading spyware.

It attempted to perform a Land attack on the SSH server.

implemented multiple decryption attacks to gain unauthorized access to encrypted email data.

The IP attempted to perform XML Attribute Blowup attacks on the Apache server.

It attempted to perform Command Injection attacks on the Apache server.

The IP attempted to perform a man-in-the-middle attack on the SASL server.

The IP attempted a Rootkit installation to gain root access and control server activity.