This IP belongs to MetLife.

This IP is linked to the distribution of commercial keyloggers designed to capture users' keystrokes.

The malicious IP attempted to exploit server misconfigurations to gain higher-level access.

It attempted to use the POP3 server to relay phishing emails.

Our logs indicated an unusually high traffic volume originating from this IP address.

Login attempts from foreign IP addresses.

The IP was flagged for performing XML External Entity attacks, exploiting improperly processed XML inputs.

It attempted to perform a credential stuffing attack on the SSH server.

It attempted to perform a Teardrop attack on the SSH server.

The IP attempted to perform a phishing attack using the SASL server.

Probing for Hidden Files: HTTP requests for files that should not be publicly accessible could suggest an attacker probing for unsecured content.

This IP belongs to Baidu.

It attempted to send emails with malicious links from the Postfix server.

The IP attempted Forceful Browsing, trying to discover hidden directories or files which could contain SSH access data.

The IP tried to manipulate DNS lookup processes to divert traffic to a malicious destination.

The IP made multiple requests with the same Via header.

This IP belongs to Facebook.

Smuggling Attack: Logs showing a single IP initiating multiple sessions, implying a Smuggling Attack.

We discovered attempts from the IP to install rootkit spyware to gain control over our systems.

The IP made multiple requests with the same Proxy-Connection header.

The IP address made multiple attempts to exploit a Remote File Inclusion (RFI) vulnerability.

This IP was distributing rogue security software, misleading users to think their systems are infected.

Participated in a botnet attack to overwhelm our server’s resources.

It attempted to exploit known vulnerabilities in the Mail protocol.

The IP attempted Forceful Browsing, trying to discover hidden directories or files which could contain SSH access data.