Multiple login attempts with slight variations in the password, suggesting a dictionary attack, a type of brute force attack.

It attempted to use the SASL server to relay spam.

The IP made multiple requests with identical Accept-Encoding headers.

This IP belongs to Dow Chemical.

The IP initiated a man-in-the-middle (MitM) attack, attempting to capture sensitive information during legitimate email exchange.

This IP belongs to CVS Health.

It attempted to use the Asterisk server as a relay for calls to premium-rate numbers.

It executed directory traversal attempts to access unauthorized directories / folders in our server.

It initiated multiple account lockouts in a short period.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

The IP initiated IP spoofing, fooling our systems to trust its malicious communication.

The IP was involved in a Ping of Death attack, sending packets larger than the maximum allowed size, causing the system to freeze or crash.

The IP attempted to send emails from the Mail server that violate the server's terms of service.

This IP belongs to Walmart.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.

This IP belongs to JPMorgan Chase.

This IP belongs to FedEx.

This IP belongs to Ubisoft.

The IP address has been marked as the source of RAM scrapers aiming to steal sensitive data.

This IP belongs to Heroku.

This IP belongs to AT&T.

This IP belongs to Home Depot.

It attempted to flood the SIP server with REGISTER requests.

The IP made multiple requests with the same If-Range header.

It attempted mail bombing, trying to overwhelm our mail server with high volumes of email.