It attempted to send emails from the Postfix server that violate the server's email content policy.

Multiple HTTP 401 Status Codes: This could indicate someone is repeatedly attempting to access resources that require valid credentials, possibly attempting to brute-force their way in.

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: request for a file often associated with an outdated version of Composer and phpunit used in a remote code execution attack.

The IP was seen trying to perform a Denial of Service (DoS) attack, attempting to make a machine or network resource unavailable to its intended users.

Multiple requests from user agents claiming to be bots (e.g., Googlebot) that do not match known bot IP ranges.

It attempted to perform HTTP Response Splitting attacks on the Apache server.

The notorious IP attempted to distribute Banker Trojans aimed to steal financial data.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

This IP belongs to Shaw Communications.

Usage of Obscure HTTP Verbs: Seeing non-standard HTTP methods like DEBUG, PUT, or CONNECT could imply a web-based attack.

It attempted to use the FTP server to distribute pirated software.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

This IP belongs to Verizon.

The IP had a series of targeted attacks distributing SpyAgents with spying functionalities.

Too Many HTTP 404 Errors: A high number of 404 Page Not Found errors may indicate an attacker trying to find valid directories or pages.

GET /vuln.html: Looking for any page vulnerabilities.

Repeated attempts to access the server using old or outdated software versions, which might have known vulnerabilities.

The IP sent malformed VOIP requests, potentially indicating an attempt to crash the server.

Initiated rogue DHCP server set up, attempting to disrupt our network and intercept emails.

This IP belongs to Travelers Cos.

The IP initiated clickjacking exploits, causing users to unwittingly perform malicious actions during SSH sessions.

It attempted to login to the POP3 server with an invalid password.

This IP belongs to United Continental Holdings.

This IP belongs to AT&T.

The IP showed unusual patterns in session IDs.