It attempted to perform a man-in-the-middle attack on the POP3 server.

It attempted to execute unauthorized commands on the Apache server.

It attempted to use the FTP server to distribute phishing emails.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

The IP attempted to use the FTP server to distribute credit card fraud tools.

It attempted to perform a phishing attack using the POP3 server.

It attempted to use the FTP server to distribute traffic monitoring tools.

The IP was part of an IRC-Bot network, a type of botnet that uses the Internet Relay Chat (IRC) protocol.

The IP attempted to use the FTP server to distribute anonymizing tools.

The IP attempted to implement a 'BlueKeep' exploit, leveraging protocol vulnerabilities to execute remote code through SSH network services.

It detected attempting time-based blind SQL injection, observing the server's response time to extract data.

It was making constant NDR (Non-Deliverable Receipt) or backscatter attacks by generating large amount of invalid email addresses.

The IP attempted to perform a credential stuffing attack on the IMAP server.

This IP belongs to Lowe's.

The IP attempted to send emails from the Postfix server without proper authentication.

This IP belongs to Freddie Mac.

This IP belongs to Zayo Bandwidth.

Uncommon Referer Header: HTTP logs record requests from an uncommon or suspicious 'Referer' header.

This IP attempted to distribute malicious Javascript files.

It attempted to perform Heap Overflow attacks on the Apache server.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

POST /modules/raptor_file_manager/upload.php: Attempt to use a known flaw in the Raptor file manager for arbitrary file upload.

It exploited CVE-specific server vulnerabilities as a backdoor entrance to our mail system.

The IP actively participated in snowshoe spamming, spreading its spam output across many IPs and domains to avoid detection.