This IP was reported for attempting a Man-in-the-Middle attack, intercepting and potentially altering communication between two parties.

It attempted to perform Web Service attacks on the Apache server.

Multiple requests with the same Expect header.

This IP belongs to Comcast.

This IP belongs to Johnson & Johnson.

It sent unusually large VOIP packets, potentially indicating a buffer overflow attempt.

Initiated a Zero-day attack, exploiting unknown vulnerabilities in our Mail and Postfix services.

It attempted to perform a SYN flood attack on the SSH server.

The IP made repeated attempts to authenticate with the Asterisk server using different usernames.

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

Multiple attempts to access the server using anonymous or generic user accounts.

The IP attempted to use the FTP server as a proxy for other malicious activities.

GET /internal/: Browsing an internal directory.

It attempted to use the FTP server to distribute phishing emails.

A majority of our user base received phishing emails originated from this particular IP address.

Multiple requests with the same X-Csrf-Token header.

The IP attempted to register with the VOIP server using an invalid username.

This IP belongs to PythonAnywhere.

GET /vuln.html: Looking for any page vulnerabilities.

The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

This IP belongs to SK Broadband.

The IP engaged in an HTTP Desync attack, misaligning HTTP request and responses to yield SSH vulnerability.

The IP attempted to login to the Postfix server with an invalid username.

It sent SIP INVITE requests to non-existent extensions.

Tried to carry out a rainbow table attack, attempting to crack hashed passwords.