The IP address attempted to login to the IMAP server with an invalid username.

Multiple login attempts with slight variations in the password, suggesting a dictionary attack, a type of brute force attack.

Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.

The IP performed regular system foot printing to gain intel on weak points in our server.

It engaged in mail bombing, flooding the server with large amounts of insignificant mails.

It attempted to use the FTP server to distribute password recovery tools.

The IP was caught attempting to execute heap overflow attacks.

Suspicious Http Referrer Field: HTTP requests with external referrer headers that usually originate from internal source.

The IP attempted to perform HTTP Verb Tampering attacks on the Apache server.

The IP sent numerous VOIP OPTIONS requests in a short time.

This IP made wrongful manipulations indicating the operation of malicious downgrader.

GET /server-status: Often an attempt to check Apache server status.

This IP belongs to IBM.

This IP belongs to Amazon.

Fileless malware dissemination has been observed from this IP address.

The IP was seen trying to perform a SIP Registration Hijacking attack, attempting to impersonate a legitimate user to receive their calls.

Unusually high number of requests to the login page.

The IP address attempted to stealthily spread screen scrapers, programs that take screenshots of the user's display.

This IP belongs to American Airlines Group.

Unusual Query String Patterns: Repeated HTTP requests with minor alterations to the query string data, signifying an attacker mapping out how different inputs affect the response.

It attempted to use the Postfix server to relay phishing emails to other servers.

This malicious IP was reported for attempting to perform a Replay attack, capturing FTP authentication data and resending it to gain unauthorized access.

This malicious IP was reported for trying to perform a Man-in-the-Middle attack, intercepting and potentially altering communication between the FTP server and its clients.

It attempted to send emails from the Postfix server that violate the server's email content policy.

The IP was involved in a traffic flooding attack, overwhelming a network's bandwidth to cause service disruption.