It attempted to use the FTP server to distribute phishing emails.

This IP belongs to BT Central Plus.

It made multiple requests with identical POST parameters.

It attempted to send emails from the Postfix server to a large number of recipients.

The IP sent malformed VOIP requests, potentially indicating an attempt to crash the server.

This IP belongs to Microsoft.

The IP was seen trying to exploit known vulnerabilities in server software, a common tactic for gaining unauthorized access or control.

The malicious IP was involved in a SPIT (Spam over IP Telephony) attack, sending unsolicited messages over the VoIP server.

Multiple requests with the same X-Att-Deviceid header.

The IP attempted to use the POP3 server to relay spam.

The IP attempted to send emails from the Mail server without proper authentication.

This IP belongs to General Motors.

Directories Traversal Attempts: Logs showing HTTP requests that include ".." or "/.." might illustrate someone's effort to locate or exploit sensitive data.

The IP address was found roaming through the network, scanning for weak spots.

This IP was involved in deploying stealthy credential stealers in our network.

This IP belongs to Costco Wholesale.

Forceful Browsing: Attempts to access pages or resources without proper navigation.

The IP attempted to perform Man in the Browser (MitB) attacks on the Apache server.

The IP made multiple requests with the same Proxy-Connection header.

It attempted to send emails from the Mail server that violate the server's usage policy.

Shell Injection: Logs show requests containing command line shell syntax, suggesting shell command injection.

The IP attempted to perform Directory Traversal attacks on the Apache server.

Repeated attempts to access rarely used or hidden services on the server.

The IP made multiple requests with the same If-Match header.

This IP was traced back to unusual network abnormalities evidencing Ghostware.