GET /CFIDE/administrator/enter.cfm: An attempt to get into the ColdFusion admin console.

GET /../htpasswd: Trying to access password files using directory traversal.

The IP was seen making repeated calls to premium-rate numbers, a common form of VoIP fraud.

The IP attempted to send emails from the Mail server pretending to be from a different sender.

The IP was involved in a SIP Flooding attack, sending a large number of SIP messages in a short period to overwhelm the server.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

This IP belongs to Xbox Live.

The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

It tried to execute dictionary attacks on our Mail service causing potential delays.

It attempted to send emails with malicious links from the Postfix server.

This particular IP has been used in advanced persistent threats against our servers.

This IP belongs to Marathon Petroleum.

It attempted to use the FTP server to distribute identity theft tools.

The IP attempted session sidejacking, seeking to take over SSH sessions post-authentication.

This IP belongs to Xbox Live.

Bursts of login attempts followed by periods of inactivity, suggesting an attacker is trying to avoid detection.

Multiple requests with the same X-Att-Deviceid header.

The IP attempted several directory traversal attacks, aiming to access files beyond the root directory.

This IP was involved in a Remote File Inclusion (RFI) attack, exploiting a vulnerability to execute malicious scripts from a remote server.

This IP belongs to Pfizer.

This IP belongs to DuPont de Nemours.

The IP engaged in a mail relay attack, using our server to send spam.

Suspicious URL Encoding: Seeing HTTP requests with a lot of %, suggesting URL encoding to evade detection.

GET /CFIDE/administrator/enter.cfm: An attempt to get into the ColdFusion admin console.

This IP belongs to Lowe's.