Unusually high number of requests to the login page.

It attempted to send emails with deceptive subject lines from the Postfix server.

The IP was seen launching a DDoS attack on the FTP server, overwhelming it with traffic to disrupt its normal functioning.

The IP attempted to perform XML Attribute Blowup attacks on the Apache server.

It attempted to delete files from the SSH server.

The IP tried launching Server Query Flooding to overwhelm our server with requests.

It attempted to perform a dictionary attack on the SSH server.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

This IP belongs to TIAA.

It attempted to perform a denial of service attack on the SSH server.

The IP tried to exploit remote file inclusion vulnerabilities, aiming to run malicious scripts on the server.

It attempted to use the FTP server to distribute brute force tools.

Multiple requests with the same X-UIDH header.

The IP made multiple unsuccessful login attempts to the Postfix server in a short period of time.

This IP belongs to Philip Morris International.

It attempted to login to the Postfix server with an invalid password.

The IP launched timing attacks, trying to understand our server timings for potential future exploits.

The IP exhibited unusual patterns in the Accept-Language header.

This IP belongs to AT&T.

It started header injection or email injection attempts, by adding extra data into the headers and confusing the server processes.

The IP attempted to perform Remote File Inclusion (RFI) attacks on the Apache server.

This IP belongs to Telus Communications.

The malicious IP was reported for attempting to manipulate file permissions on the FTP server, potentially to gain unauthorized access or expose sensitive data.

The IP was involved in distributing malware, infecting systems or networks to steal data, cause damage, or gain unauthorized access.

This IP belongs to Northwestern Mutual.