GET /administrator.php: Attempting to access an admin interface.

It attempted to send emails from the Postfix server that violate the server's email content policy.

It was involved in a Distributed Denial of Service (DDoS) attack.

It partook in whaling attacks, specifically targeting high-profile users within our system.

Multiple requests with the same Warning header.

The IP was involved in a FTP Flood attack, sending a large number of FTP connection requests to overwhelm the server.

Multiple attempts to access the server using different ports or protocols.

It attempted to send emails from the Postfix server to email addresses that have previously marked emails from the server as spam.

There were several attempts from this IP to manipulate our server DNS records.

Multiple requests with identical cookies.

The malicious IP attempted ARP spoofing to fool the server into sending information to the wrong destination.

Unusual Query String Patterns: Repeated HTTP requests with minor alterations to the query string data, signifying an attacker mapping out how different inputs affect the response.

Repeated connections to the server from unknown or suspicious IP addresses.

The IP was caught attempting to exploit known vulnerabilities within Postfix to gain unauthorized access.

This IP belongs to Tech Data.

This IP belongs to Slack.

Multiple requests with the same Referer header.

The IP was caught trying to overload the server through a Distributed Denial of Service attack.

It attempted to perform a brute force attack on the IMAP server.

The IP attempted to perform a SNMP amplification attack on the SSH server.

The IP attempted to delete files from the FTP server.

Repeated pings or probe requests to the server, indicating a potential reconnaissance effort before the attack.

This IP was traced back to unusual network abnormalities evidencing Ghostware.

The IP was seen attempting a Dictionary attack on the FTP server, systematically entering every word in a dictionary as a password to find the correct one.

Code Injection: Usage of standard codes (like Base64) to obscure attack payloads or commands.