The IP attempted to use the Mail server to relay phishing emails to other servers.

This IP belongs to MTN.

Multiple failed login attempts from the same IP address in a short span of time.

Unknown source code changes in our system were linked back to this offensive IP address.

It attempted to send emails with malicious links from the Postfix server.

The IP attempted to mark emails as read on the POP3 server without authorization.

Reverse Tabnabbing Attempts: Logs illustrating target="_blank" in URL, which is a sign of reverse tabnabbing attempt.

This IP was responsible for circulating malicious images masked with spyware.

It repetitively attempted Port Scanning to identify open ports and related vulnerabilities.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

This IP belongs to Valero Energy.

The IP attempted to send emails with misleading headers from the Mail server.

Unusual Query String Patterns: Repeated HTTP requests with minor alterations to the query string data, signifying an attacker mapping out how different inputs affect the response.

This IP belongs to FedEx.

It made multiple requests with the same X-Forwarded-For header.

It attempted to perform a credential stuffing attack on the SSH server.

Participated in a botnet attack to overwhelm our server’s resources.

This IP has been marked as the origin of numerous SQL injection attacks.

The IP attempted to send emails from the Mail server that violate the server's email sending limits.

The IP attempted to change file permissions on the SSH server.

The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

The detected IP address was responsible for the distribution of botnets aimed at automating data theft.

This IP belongs to FedEx.

The IP attempted to send spam emails from the Mail server.

The IP attempted to perform a Bonk attack on the SSH server.