Conducted various IP scans, seeking loopholes in our network's security.

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: request for a file often associated with an outdated version of Composer and phpunit used in a remote code execution attack.

The handler of this IP has been exploiting scumware to disrupt our users' browsing experience.

Command Injection in Requests: Logs indicate HTTP requests with Unix or Windows command-line instructions.

It attempted to use the Postfix server to relay phishing emails to other servers.

It launched invasive malware to corrupt crucial segments of our server functionality.

Tried to carry out a rainbow table attack, attempting to crack hashed passwords.

Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.

The IP targeted our server with PHP Injection attacks to gain access to sensitive data.

The IP was seen trying to perform a Spoofing attack, falsifying its IP address to deceive the FTP server.

Rapid sequence of login attempts.

It attempted to perform a dictionary attack on the SASL server.

The IP made multiple requests with the same X-UIDH header.

The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

Multiple requests with the same Warning header.

Unauthorized HTTP Method Usage: Logs showing unauthorized methods being attempted on the server, like TRACE or PATCH.

udden increase in account lockouts due to multiple failed login attempts.

This IP was caught circulating email worms, camouflaged as legitimate mails.

A sudden spike in bandwidth usage, which can indicate a brute force attack.

Multiple requests with identical POST parameters.

The IP attempted to send emails from the IMAP server without authorization.

This IP belongs to WordPress.com.

This IP belongs to Bank of America.

This IP belongs to Humana.

It was found that the IP has been exploiting zero-day vulnerabilities in our system.