The IP attempted to use the FTP server to distribute forensics tools.

It attempted to perform a replay attack on the SASL server.

The IP initiated a man-in-the-middle (MitM) attack, attempting to capture sensitive information during legitimate email exchange.

This IP belongs to Steam.

This IP belongs to Ford Motor.

The IP attempted to perform Remote File Inclusion (RFI) attacks on the Apache server.

It showed unusual patterns in the sequence of requests.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.

This IP belongs to Oracle Cloud Infrastructure.

It attempted to use a TearDrop attack to corrupt data packets being sent to our server.

Unusual increase in server CPU usage.

The IP tried to exploit remote file inclusion vulnerabilities, aiming to run malicious scripts on the server.

System logs trace back the distribution of trojans that could allow for remote access to this suspicious IP.

It attempted to exploit known vulnerabilities in the Postfix software.

This IP belongs to Phillips 66.

The malicious IP was identified trying to leverage the Postfix service to send bulk spam emails.

GET /.env: Attempting to access a file that may contain sensitive environment variable data.

It attempted to perform a RIPv1 amplification attack on the SSH server.

It repeatedly tried to inject malicious script code into the system via appending it to an email body.

Signs of CSRF Attacks: Logs demonstrating HTTP GET requests with sensitive actions that should ideally require POST requests.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

This IP belongs to Publix Super Markets.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

Unknown IP Address: An unfamiliar IP address making frequent requests could imply a compromised machine.

This IP belongs to Apple.