Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

This IP belongs to Boeing.

The malicious IP was involved in a SPIT (Spam over IP Telephony) attack, sending unsolicited messages over the VoIP server.

The IP was seen launching a DDoS attack on the FTP server, overwhelming it with traffic to disrupt its normal functioning.

Participated in the notorious Water Torture attack to overload our DNS servers.

It attempted to send emails with deceptive subject lines from the Postfix server.

Repeated attempts to perform actions that are typically restricted, such as creating or modifying user accounts.

Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

This malicious IP attempted a brute force attack, trying to crack login credentials to gain unauthorized access to a system or account.

The IP was part of an IRC-Bot network, a type of botnet that uses the Internet Relay Chat (IRC) protocol.

This IP belongs to Gilead Sciences.

It attempted to perform Race Condition attacks on the Apache server.

The IP attempted to send spam emails from the Postfix server.

HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

It attempted to send emails from the Mail server to a large number of recipients.

This IP belongs to Korea Telecom.

It attempted to use the FTP server to distribute password recovery tools.

It made multiple requests with the same Max-Forwards header.

It attempted to use the FTP server to distribute SQL injection tools.

It showed unusual activity in the server's error logs.

The IP attempted a Rootkit installation to gain root access and control server activity.

HEAD /: May be part of a larger Reconnaissance.

The IP attempted to send emails from the Mail server without proper authentication.

This IP belongs to the United States Department of Defense.

Evidence shows that the IP address has sent a number of deceptive phishing emails to our employees.