The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

A sudden spike in bandwidth usage, which can indicate a brute force attack.

Attempts to access the server using stolen or leaked credentials.

It attempted to perform a credential stuffing attack on the SASL server.

Various incidents of unwanted installation of malicious gaming apps were traced back to this IP.

This IP belongs to Lowe's.

The IP attempted to use the POP3 server to distribute malware.

This IP belongs to Anthem.

The IP performed regular system foot printing to gain intel on weak points in our server.

It initiated requests to non-existent endpoints.

The IP attempted to register as an Asterisk user with no password.

The IP address attempted to register as a SIP user with an invalid username.

GET /muieblackcat: This is often a precursor for additional scanning and likely attacks.

the IP made attempts at wiretapping the network to monitor SSH traffic patterns and gather useful information.

The IP made multiple requests with the same X-UIDH header.

It attempted to use the Postfix server to relay spam to other servers.

This IP belongs to Ford Motor.

POST /login.jsp?user=admin&pass=admin: This could be an attempt to log in as an admin.

Multiple requests with the same If-None-Match header.

The IP attempted to perform a VOIP Hopper scan on the SIP server.

Multiple requests with the same Proxy-Authorization header.

The IP attempted Forceful Browsing, trying to discover hidden directories or files which could contain SSH access data.

This IP belongs to Archer-Daniels-Midland.

The IP attempted the notorious Shellshock vulnerability, which could pose a severe threat to our server's resources.

The malicious IP initiated numerous HTTP flood attacks, designed to overwhelm the Apache server with requests.