Unexpected changes in the server configuration or installed software.

Repeated attempts to alter or delete log files to cover tracks.

This IP belongs to Telstra.

The IP was seen trying to perform a Fraggle attack, a type of DDoS attack where the attacker sends a large amount of UDP traffic to a router's broadcast network.

This IP belongs to Freddie Mac.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

This IP belongs to AT&T.

The IP was engaged in email append attacks, trying to add addresses to an existing email or response mid-transit.

It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

It attempted to perform a brute force attack on the IMAP server.

It sent unusually large SIP packets, potentially indicating a buffer overflow attempt.

Repeated HTTP requests with error codes, indicating failed attempts to access restricted areas.

The malicious IP tried to depreciate the reputation of our mail server by sending out numerous spam mails.

The IP attempted to perform ARP Spoofing attacks on the Apache server.

This IP belongs to Microsoft.

The IP attempted to perform a downgrade attack on the SSH server.

It was discovered using our server in an open relay configuration, sending emails from unauthorized domains.

It attempted to perform Server Side Request Forgery (SSRF) attacks on the Apache server.

It attempted to login to the FTP server with an invalid password.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

This IP belongs to Dell Technologies.

Unusual patterns in user agent strings.

This IP belongs to IBM.

This IP belongs to Anthem.

The IP attempted to use the FTP server to distribute spam.