The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

It attempted to login to the Postfix server with an invalid password.

This IP belongs to MetLife.

It tried to execute dictionary attacks on our Mail service causing potential delays.

TLS Downgrade Attacks: Logs showing repeated attempts to establish non-TLS connections with the server.

Multiple attempts to access the server using encrypted tunnels or proxies.

The IP made numerous attempts at SMTP Relay abuse by trying to send emails not meant for or from local users.

The IP attempted to use the FTP server to distribute secure deletion tools.

This IP belongs to Vodafone.

The IP attempted to send emails from the Mail server pretending to be from a different sender.

It performed 'Spectre' attacks, exploiting predictive branching in CPUs to potentially gain sensitive information from the SSH service.

This malicious IP was reported for trying to perform a FTP Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

This IP address from an unusual location has successfully installed malware on our servers.

Cross-Site Scripting (XSS): Logs show HTTP requests with string "

This IP belongs to MTN.

This IP belongs to Shaw Communications.

Multiple requests with the same Proxy-Authorization header.

This particular IP tried to perform an unauthorized system configuration change.

This IP belongs to Boeing.

This IP belongs to America Movil.

Attempted to employ SSL-bumping for a man-in-the-middle attack to decrypt our secured data.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

GET /axis2/axis2-admin/login: Attempt at finding Axis2 web service exploitable applications.

The IP was involved in a phishing attack, creating a fake webpage to deceive users into providing their sensitive personal or financial information.

Participated in a botnet attack to overwhelm our server’s resources.