The IP tried to initiate DNS tunneling for smuggling data through SSH.

The IP attempted to inject malicious scripts into the server hoping it would get executed.

This IP belongs to PythonAnywhere.

Unusual command line activities that are not typical for the server environment.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

The IP attempted reconnaissance activities, trying to footprint our server’s network.

Unexpected changes in the server configuration or installed software.

It pushed humongous quantities of spam emails through our server, aiming to congest our email services.

The IP attempted Forceful Browsing, trying to discover hidden directories or files which could contain SSH access data.

This IP belongs to Alphabet.

The IP attempted to perform a replay attack on the IMAP server.

It attempted to perform a phishing attack using the IMAP server.

It showed unusual activity in the server's error logs.

The IP attempted to send emails from the Mail server that violate the server's email sending limits.

It attempted to use the IMAP server to relay spam.

The IP attempted to perform a SIP Invite Flood on the SIP server.

A series of active scareware campaigns was traced back to this IP address.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

The IP made multiple requests with the same Warning header.

Login Attempts on Non-Existent Users: Many login requests for non-existent usernames could suggest a blind username enumeration attack.

The IP attempted to download emails from the POP3 server without authorization.

We identified the IP address as a source of numerous scare tactics spyware.

The IP attempted to perform a dictionary attack on the POP3 server.

POST /xmlrpc.php: Could indicate an attempt at exploiting the WordPress xmlrpc.php file, often used for brute forcing.

Initiated a Zero-day attack, exploiting unknown vulnerabilities in our Mail and Postfix services.