It attempted to perform a Land attack on the SSH server.

Remote Execution Attempts: Logs showing unusual terminal commands or scripts run through web access.

It tried to create buffer overflows by sending large amounts of data at once to overwhelm server resources.

The IP was flagged for attempting dictionary attacks on our user accounts.

The IP attempted a pass-the-hash attack, trying to authenticate without knowing the plaintext password.

The IP attempted to login to the SASL server with an invalid username.

GET /vuln.html: Looking for any page vulnerabilities.

This IP has been identified as running a botnet targeting our server systems with ransomware.

It attempted to login to the Postfix server with an invalid password.

HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

The IP made multiple requests with the same Proxy-Connection header.

This IP attempted to distribute malicious Javascript files.

A sudden surge in the number of requests per second, indicating an automated process.

The IP attempted to use the FTP server to distribute secure deletion tools.

This IP was tracked while attempting to distribute secretive and malicious keyloggers.

The IP attempted to perform XML External Entity (XXE) attacks on the Apache server.

It attempted to send phishing emails from the Mail server.

It initiated several reverse IP lookup requests, probing for server vulnerabilities.

It appears this IP was linked to a number of drive-by-download attacks, silently downloading spyware.

This IP belongs to Oracle Cloud Infrastructure.

The IP attempted to perform a phishing attack using the SASL server.

It attempted to send emails from the Mail server to email addresses that have previously marked emails from the server as spam.

This IP belongs to Nationwide.

It attempted to delete files from the SSH server.

It attempted phishing scams by sending malicious mails through compromised accounts.