The malicious IP was reported for sending a high volume of SIP INVITE requests, a potential sign of a call flooding attack.

This IP belongs to World Fuel Services.

The IP tried to perform a cross-site request forgery attack on the IMAP service.

It attempted mail bombing, trying to overwhelm our mail server with high volumes of email.

This IP belongs to PepsiCo.

It tried to create buffer overflows by sending large amounts of data at once to overwhelm server resources.

Multiple requests with the same X-Att-Deviceid header.

Repeated attempts to perform actions that are typically restricted, such as creating or modifying user accounts.

The IP attempted to use the FTP server to distribute zero-day exploit tools.

It attempted to exploit known vulnerabilities in the SASL protocol.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.

It attempted to perform a Sentinels amplification attack on the SSH server.

The IP attempted to perform XML External Entity (XXE) attacks on the Apache server.

This IP belongs to Hong Kong Broadband Network.

It performed botnet operations, controlling a group of “zombie” computers to amplify its DDoS attacks.

Path/File Enumeration: Logs show multiple HTTP requests to non-existing pages and incrementing filenames, suggesting file or path enumeration.

It attempted to use the FTP server to distribute phishing emails.

It attempted to perform a phishing attack using the POP3 server.

The IP tried to exploit buffer overflow vulnerabilities to run unauthorized code.

It made successive tries to alter SMTP relay configurations to send unsolicited emails.

This IP belongs to Jabil.

It sent SIP INVITE requests to non-existent extensions.

It attempted to perform a SIP Register Flood on the Asterisk server.

The IP attempted to send emails from the Postfix server pretending to be from a different sender.

It attempted to send emails from the Mail server to email addresses that have previously marked emails from the server as spam.