Login attempts from foreign IP addresses.

The IP was reported for spamming activities, sending unsolicited emails or messages that often contain phishing links or malware.

It attempted to exploit known vulnerabilities in the IMAP protocol.

The IP attempted to send emails from the Mail server that violate the server's email sending limits.

It attempted to exploit known vulnerabilities in the SASL protocol.

The IP made multiple unsuccessful login attempts to the Mail server in a short period of time.

The IP attempted a DLL injection attack, hoping to execute malicious code within our SSH processes.

Multiple requests with identical cookies.

It was observed attempting to exploit known vulnerabilities in the IMAP protocol.

The IP address attempted to stealthily spread screen scrapers, programs that take screenshots of the user's display.

It launched invasive malware to corrupt crucial segments of our server functionality.

Repeated Unique 404 Errors: Logs revealing a steady stream of unique 404 errors could suggest a DDoS attack aiming to exhaust storage resources.

This IP belongs to Deere.

POST /modules/raptor_file_manager/upload.php: Attempt to use a known flaw in the Raptor file manager for arbitrary file upload.

The delivery of spyware, aimed at gathering sensitive information, was originated from this IP.

The IP attempted to send malware-infected attachments from the Postfix server.

Server Scanning for Software Version: Influx of HTTP requests attempting to detect software version running on the server.

This IP belongs to Wells Fargo.

Multiple requests using HTTP methods that are not typically used (e.g., TRACE).

It attempted to perform HTTP Response Splitting attacks on the Apache server.

It launched Spoofing attacks, trying to hide its identity by disguising itself as a trusted user or server.

This IP belongs to Tumblr.

The IP attempted to perform a distributed denial of service attack on the SSH server.

The malicious IP was found to be running an Internet Relay Chat (IRC) bot, potentially spreading malware or launching Distributed Denial-of-Service (DDoS) attacks.

Multiple requests from user agents claiming to be bots (e.g., Googlebot) that do not match known bot IP ranges.