GET /etc/passwd: An attempt to retrieve Linux server user account details.

It attempted to send emails from the Mail server that violate the server's acceptable use policy.

Multiple requests with the same DNT (Do Not Track) header.

The IP attempted to use the FTP server to distribute zero-day exploit tools.

The IP attempted to perform a Fraggle attack on the SSH server.

The IP attempted to download emails from the POP3 server without authorization.

Multiple requests with the same If-Range header.

This IP was detected initiating zero-day exploit attacks on our system.

The IP attempted a Rootkit installation to gain root access and control server activity.

The IP attempted to send emails from the Mail server to blacklisted email addresses.

Multiple requests with identical Accept-Charset headers.

The IP was flagged for performing XML External Entity attacks, exploiting improperly processed XML inputs.

Server Side Template Injection: Suspicious input patterns aimed at coercing server-side parsers to execute injected code.

It executed directory traversal attempts to access unauthorized directories / folders in our server.

The IP was actively seeking unpatched SSH software in hope of finding exploitable vulnerabilities.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

This IP belongs to Apple.

It partook in whaling attacks, specifically targeting high-profile users within our system.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

This IP was tracked while attempting to distribute secretive and malicious keyloggers.

The IP attempted to send emails from the Postfix server pretending to be from a different sender.

This malicious IP attempted a brute force attack, trying to crack login credentials to gain unauthorized access to a system or account.

Multiple login attempts from different geographical locations in a short period of time.

The IP attempted a pass-the-hash attack, trying to authenticate without knowing the plaintext password.

The IP attempted to exploit a mail server's greylisting functionality to bypass spam filters.