The IP was discovered trying Server Message Block relay attacks to gain unauthorized SSH access.

It was responsible for an unusual increase in server CPU usage.

It attempted to send emails from the Postfix server to a large number of recipients.

Multiple requests with the same TE (Transfer Encoding) header.

It attempted to perform WSDL Enumeration attacks on the Apache server.

It carried out key logging attempts, hoping to record keyboard inputs during SSH sessions.

The IP attempted to perform a timing attack on the SSH server.

It was discovered using our server in an open relay configuration, sending emails from unauthorized domains.

The IP attempted to perform a VOIP Hopper scan on the SIP server.

This IP belongs to GoDaddy.

This IP belongs to Verizon Communications.

The IP attempted to use the FTP server to distribute steganography tools.

This IP belongs to Reliance Jio.

This IP belongs to Walmart.

The IP has been distributing browser hijackers that alter the user's browsing experience without their consent.

The IP attempted to send emails from the Postfix server without proper authentication.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

This IP belongs to Fannie Mae.

HEAD /: May be part of a larger Reconnaissance.

This IP belongs to Telus Communications.

This IP directed malicious network traffic to our servers with the intent to crash them.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.

The IP was actively engaged in spear-phishing attacks, aimed at high-ranking officials within our network.

The malicious IP was spotted attempting to brute-force the SSH login credentials.