This IP belongs to Heroku.

It attempted to login to the SASL server with an invalid password.

Unknown IP Address: An unfamiliar IP address making frequent requests could imply a compromised machine.

This IP belongs to Phillips 66.

It was found actively trying to exploit HTTP Response Splitting vulnerabilities to perform further attacks.

Login attempts at unusual times (e.g., in the middle of the night).

It attempted to perform a password spraying attack on the IMAP server.

This IP has been observed spreading mobile malware, targeting our company application users.

System logs have traced multiple cases of our servers being bombed with trojans to this IP.

The IP attempted to send emails with misleading headers from the Postfix server.

It attempted to perform a SIP Brute Force attack on the SIP, VOIP, or Asterisk server.

The IP engaged in DNS Spoofing, rerouting our server's lookups to a malicious destination.

This IP belongs to British Telecommunications.

Multiple requests with identical POST parameters.

This IP belongs to the University of California, Berkeley.

The IP was seen trying to perform a Denial of Service (DoS) attack, attempting to make a machine or network resource unavailable to its intended users.

GET /errors.log: Shows an actor trying to access server error logs.

This IP belongs to United Continental Holdings.

Unusual activity in the server's error logs.

It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

Multiple requests to the same endpoint in a short period of time.

Multiple requests with identical Accept-Charset headers.

The IP attempted to perform Symlink attacks on the Apache server.

The IP attempted several directory traversal attacks, aiming to access files beyond the root directory.

We flagged down attempts from the IP to leak backdoor viruses into the system.