It attempted to perform Unvalidated Redirects and Forwards attacks on the Apache server.

Connection Timeout Abuse: Logs illustrating excessive requests that aim to use up server connections.

It attempted to use the IMAP server to relay spam.

Multiple requests from different IP addresses in a short span of time, suggesting a distributed brute force attack.

It attempted to flood the Asterisk server with REGISTER requests.

High network traffic at unusual times, suggesting an automated process is running.

The IP made multiple requests using uncommon HTTP methods.

This IP belongs to United Continental Holdings.

This IP belongs to Ford Motor.

It partook in whaling attacks, specifically targeting high-profile users within our system.

This malicious IP was reported for attempting a Zero-day exploit, exploiting a software vulnerability before it's known or fixed by the vendor.

Multiple unsuccessful attempts to escalate privileges or access root account.

It tried to execute a Rainbow Table attack, aiming to break the encryption used in SSH password protection.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

The IP was seen attempting a FTP Smurf attack, flooding the FTP server with echo request packets to cause a denial of service.

Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.

Unexpected changes in the server configuration or installed software.

The IP attempted to send malware-infected attachments from the Postfix server.

It's observed that the IP operated a series of attacks exploiting insecure direct object references.

It engaged in mail bombing, flooding the server with large amounts of insignificant mails.

The IP was recorded making persistent attempts to crack our encryption.

This malicious IP was reported for attempting a Session Hijacking attack, exploiting a valid computer session to gain unauthorized access to information or services.

Distributed session hijackers from the IP were designed to capture and exploit web browser sessions.

The IP attempted to create new directories on the FTP server.

It started header injection or email injection attempts, by adding extra data into the headers and confusing the server processes.