It attempted to exploit known vulnerabilities in the Postfix software.

This IP has been observed spreading mobile malware, targeting our company application users.

This IP belongs to Exxon Mobil.

Repeated failed attempts to perform actions that require higher privileges.

It made multiple requests with the same X-Csrf-Token header.

This IP belongs to Hostgator.

The IP made multiple unsuccessful login attempts to the IMAP server in a short period of time.

Repeated attempts to access directories or files that do not exist or are typically not accessed.

The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

The IP tried to launch 'Dark Tequila' malware that steals banking information and login credentials from the server.

Unusual network traffic patterns, such as a high amount of outbound traffic.

Participated in a botnet attack to overwhelm our server’s resources.

The IP made multiple requests with the same Warning header.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

The IP attempted to inject malicious scripts into the server hoping it would get executed.

This IP belongs to Nintendo.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

The IP was involved in a RTP Mix attack, injecting RTP packets into an ongoing VoIP call to disrupt communication.

The specific IP has been identified attempting to load malicious browser helper objects into the network.

It attempted command injection attacks, hoping to execute unauthorized commands.

POST /xmlrpc.php: Could indicate an attempt at exploiting the WordPress xmlrpc.php file, often used for brute forcing.

It tried to execute dictionary attacks on our Mail service causing potential delays.

Multiple requests with the same X-UIDH header.

This IP address from an unusual location has successfully installed malware on our servers.

It made multiple requests with the same X-Wap-Profile header.