It utilized Web scrapers, automatically harvesting content from our server.

Login Attempts with Automated User-Agents: Logs reflect requests to login page with 'bot' or 'spider' in user-agent strings.

Conducted various IP scans, seeking loopholes in our network's security.

It repeatedly tried to inject malicious script code into the system via appending it to an email body.

This IP belongs to FedEx.

The IP performed regular system foot printing to gain intel on weak points in our server.

The IP attempted to send malware-infected attachments from the Postfix server.

Too Many HTTP 404 Errors: A high number of 404 Page Not Found errors may indicate an attacker trying to find valid directories or pages.

The IP made multiple requests to the password reset page.

Made various attempts at a forged return-path attack, attempting to spoof their source email address.

Evidence shows that the IP address has sent a number of deceptive phishing emails to our employees.

Participated in malicious pranks by altering messages sent through the server.

It executed blind command injection, exploiting server inputs to gain unauthorized system control.

POST /j_security_check: May indicate an attempt to bypass Java server page (JSP) login mechanisms.

This IP belongs to Alibaba Cloud Services.

The IP attempted to perform a Kad network amplification attack on the SSH server.

The IP sent numerous SIP OPTIONS requests in a short time.

It attempted to perform a SSDP amplification attack on the SSH server.

Multiple requests with the same Origin header.

Repeated attempts to access the server using old or outdated software versions, which might have known vulnerabilities.

The IP was recorded making persistent attempts to crack our encryption.

The IP performed forceful browsing, to access and exploit unprotected files and directories.

It attempted to use the Postfix server to relay phishing emails to other servers.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

This malicious IP was reported for trying to inject malicious scripts into the VoIP server, potentially to disrupt its operation or steal data.