This IP belongs to The Hartford Financial Services.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

Multiple requests with the same Expect header.

The IP attempted session sidejacking, seeking to take over SSH sessions post-authentication.

It attempted to use the SASL server to distribute malware.

It launched Smurf Attacks, trying to overload our mail server by utilizing internet host IP network links.

It attempted to exploit known vulnerabilities in the FTP protocol.

The IP was involved in a phishing attack, creating a fake webpage to deceive users into providing their sensitive personal or financial information.

It was caught injecting malicious code into the SSH session attempting to compromise server integrity.

POST /admin/upload.php?_upl: An attempt to exploit the JQuery File Upload vulnerability.

It attempted to perform a phishing attack using the POP3 server.

The IP attempted to send emails from the Postfix server to blacklisted email addresses.

The IP attempted to send emails with misleading headers from the Mail server.

The IP address attempted to login to the FTP server with an invalid username.

This IP belongs to Best Buy.

This IP belongs to Nationwide.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

The IP was discovered trying Server Message Block relay attacks to gain unauthorized SSH access.

It attempted to perform a Land attack on the SSH server.

This IP belongs to Home Depot.

The IP was involved in a FTP Injection attack, exploiting vulnerabilities in the FTP server to execute unauthorized commands.

Repeated attempts to access the server using old or outdated software versions, which might have known vulnerabilities.

The IP attempted to perform a distributed denial of service attack on the SSH server.

The IP attempted code injection attacks, injecting malicious codes in HTTP headers.

This IP belongs to Softbank.