Multiple failed login attempts from the same IP address in a short span of time.

The IP attempted to use the Mail server to relay emails with misleading headers to other servers.

The IP attempted to perform a phishing attack using the SASL server.

It attempted to send phishing emails from the Mail server.

The suspicious IP indulged in Mitnick attacks, manipulating user trust to gain confidential info.

This IP belongs to Johnson & Johnson.

This IP belongs to Linode.

It attempted to perform a session hijacking attack on the SSH server.

The IP attempted Forceful Browsing, trying to discover hidden directories or files which could contain SSH access data.

This malicious IP was reported for trying to perform a Symlink attack, creating symbolic links to files outside the FTP server's root directory.

Attempts to access the server using unusual HTTP methods or request types.

It attempted to exploit known vulnerabilities in the SASL protocol.

Multiple requests with the same If-None-Match header.

Probing for Hidden Files: HTTP requests for files that should not be publicly accessible could suggest an attacker probing for unsecured content.

The IP attempted to login to the Postfix server with an invalid username.

It attempted to use the FTP server to distribute encryption tools.

A majority of our user base received phishing emails originated from this particular IP address.

Participated in the notorious Water Torture attack to overload our DNS servers.

The IP was seen attempting a SYN Flood attack, overwhelming the server by rapidly initiating a connection but not completing it, thereby consuming server resources.

This IP belongs to Marathon Petroleum.

The IP attempted to mark emails as read on the POP3 server without authorization.

This IP belongs to Target.

An alarming frequency of microphone loggers has been traced back to this IP.

This IP belongs to Archer-Daniels-Midland.

The IP attempted the notorious Shellshock vulnerability, which could pose a severe threat to our server's resources.