This IP belongs to Cloudfare.

Repeated attempts to access directories or files that do not exist or are typically not accessed.

The IP made multiple requests with the same If-Match header.

It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

It attempted to exploit known vulnerabilities in the IMAP protocol.

The IP was actively seeking unpatched SSH software in hope of finding exploitable vulnerabilities.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

The malicious IP attempted to gain unauthorized access to the server by repeatedly trying different username and password combinations.

The IP under scrutiny has been associated with multiple modem hijackers.

This IP belongs to Berkshire Hathaway.

It was identified as a BadBot, a type of bot that performs malicious activities.

It sent unusually large VOIP packets, potentially indicating a buffer overflow attempt.

This IP belongs to Caterpillar.

Our logs indicated an unusually high traffic volume originating from this IP address.

The IP sent numerous SIP OPTIONS requests in a short time.

The IP attempted to send emails from the Mail server pretending to be from a different sender.

The IP attempted to perform a brute force attack on the SSH server.

The IP attempted fileless malware attacks, directly injecting malicious script into server memory.

The IP set off alarms for an attempted man-in-the-middle attack on our servers.

GET /.env: Attempting to access a file that may contain sensitive environment variable data.

Unauthorized HTTP Method Usage: Logs showing unauthorized methods being attempted on the server, like TRACE or PATCH.

This IP belongs to Tech Data.

Repeated connections to the server from unknown or suspicious IP addresses.

The IP made multiple requests to the password reset page.

Attempts to access the server using unusual HTTP methods or request types.