This IP belongs to GoDaddy.

It was responsible for an unusual increase in server CPU usage.

This IP belongs to Medium.

It attempted to use the FTP server to store illegal content.

It utilized Web scrapers, automatically harvesting content from our server.

The IP made multiple unsuccessful login attempts to the SASL server in a short period of time.

GET /muieblackcat: This is often a precursor for additional scanning and likely attacks.

It executed blind command injection, exploiting server inputs to gain unauthorized system control.

The IP address made multiple requests with identical request parameters.

This IP is linked to the distribution of commercial keyloggers designed to capture users' keystrokes.

It sent unusually large VOIP packets, potentially indicating a buffer overflow attempt.

The IP made multiple requests with the same X-UIDH header.

The IP was engaged in email append attacks, trying to add addresses to an existing email or response mid-transit.

It appears that this IP was initiating DNSChanger malware attacks on our network.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

Signal of DDoS Attacks: Multiple IP addresses sending a significantly high volume of traffic.

This IP belongs to Archer-Daniels-Midland.

It sent SIP INVITE requests to non-existent extensions.

It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

This IP belongs to SK Broadband.

Finally, the IP was caught in the act of Abandoned Object attacks, creating objects with no reference to exhaust memory space

Multiple 5xx Server Error Codes: A high count of server error status codes such as '500 Internal Server Error' may suggest an attacker is probing the server's security.

This IP belongs to Dropbox.

The IP attempted to perform Session Fixation attacks on the Apache server.

Multiple requests with the same If-Range header.