The IP made multiple requests to the server's robots.txt file.

It attempted to send phishing emails from the Postfix server.

This IP was detected distributing spyware-infected USB drives to our users.

Our system blocked an attempted Code Injection attack from this IP.

It attempted to use the FTP server to distribute virus creation tools.

IP Spoofing: Logs showing HTTP requests with IP ranges that are typically reserved for private networks or an unusual X-Forwarded-For header.

It actively sought to exploit unpatched software within our server applications.

It attempted to perform a credential stuffing attack on the SSH server.

Attempts to access the server using credentials that have been involved in previous security incidents.

The malicious IP was found trying to exploit the IMAP 'unselect' vulnerability.

The IP showed unusual patterns in referrer URLs.

The IP made multiple unsuccessful login attempts to the Mail server in a short period of time.

It attempted to perform Session Sidejacking attacks on the Apache server.

Multiple attempts to access the server using different ports or protocols.

Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

This IP attempted to distribute malicious Javascript files.

This IP belongs to Sony Network Communications.

It attempted to perform a phishing attack using the IMAP server.

It was discovered using our server in an open relay configuration, sending emails from unauthorized domains.

Server Side Request Forgery Attempts: Logs may show HTTP requests attempting to manipulate the server into making unintended requests.

The IP was caught attempting to exploit known vulnerabilities within Postfix to gain unauthorized access.

It performed botnet operations, controlling a group of “zombie” computers to amplify its DDoS attacks.

The IP attempted to perform Session Hijacking attacks on the Apache server.

By leveraging the AgeTunnel software, the IP attempted to establish a covert channel across the SSH session.