The IP made multiple unsuccessful login attempts to the POP3 server in a short period of time.

It appears this IP was linked to a number of drive-by-download attacks, silently downloading spyware.

The IP attempted to perform Missing Function Level Access Control attacks on the Apache server.

This IP belongs to IBM.

Attempts to access the server using credentials that have been involved in previous security incidents.

It attempted to use the Postfix server to relay emails with malicious links to other servers.

The IP attempted to perform a DNS amplification attack on the SSH server.

HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

It attempted to delete emails from the IMAP server without authorization.

The IP attempted to perform XML Injection attacks on the Apache server.

This malicious IP was reported for trying to perform a Symlink attack, creating symbolic links to files outside the FTP server's root directory.

This IP belongs to Phillips 66.

This IP belongs to Berkshire Hathaway.

It utilized a Directory Harvest Attack, attempting to find valid e-mail addresses through guesswork.

GET /login.action: Trying to find a Struts2 application to exploit.

It launched header-based exploits, attempting to manipulate HTTP headers to cause inappropriate server responses.

This IP belongs to Deutsche Telecom.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

The IP attempted to use the Mail server to relay emails with malicious links to other servers.

It attempted to use the SASL server to distribute malware.

The IP was involved in a SIPVicious attack, a specific type of VoIP attack that scans for open SIP servers and then attempts to crack their passwords.

Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.

Directories Traversal Attempts: Logs showing HTTP requests that include ".." or "/.." might illustrate someone's effort to locate or exploit sensitive data.

Repeated Unique 404 Errors: Logs revealing a steady stream of unique 404 errors could suggest a DDoS attack aiming to exhaust storage resources.

This IP addressed employed a method of brute force attack attempting to compromise our systems.