This IP was suspected of running a botnet, a network of compromised computers used for malicious activities like spamming or DDoS attacks.

It attempted to send emails with malicious links from the Mail server.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

This specific IP was marked for unauthorized browser changes implying browser hijackers.

Attempts to access sensitive areas of the server, such as the admin page or user account information.

This IP belongs to World Fuel Services.

This IP belongs to Amazon.

Multiple requests with the same If-Range header.

The IP made multiple unsuccessful login attempts in a short period of time.

It attempted to use a TearDrop attack to corrupt data packets being sent to our server.

The IP was reported for attempting a Cross-Site Scripting attack, injecting malicious scripts into websites to steal data or disrupt functionality.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

Multiple requests with the same Proxy-Connection header.

This IP belongs to Telefonica Spain.

This IP directed malicious network traffic to our servers with the intent to crash them.

It attempted to perform Clickjacking attacks on the Apache server.

It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

Multiple HTTP 401 Status Codes: This could indicate someone is repeatedly attempting to access resources that require valid credentials, possibly attempting to brute-force their way in.

This IP was seen scanning for open ports and vulnerabilities, a common reconnaissance activity before launching attacks.

A large number of requests from a single user agent, suggesting an automated process.

Remote File Inclusion (RFI): You might see HTTP requests with "=http" or "=ftp" which can signal an attempt for remote file inclusion.

The IP made multiple unsuccessful login attempts to the Postfix server in a short period of time.

It attempted to perform Local File Inclusion (LFI) attacks on the Apache server.

This IP belongs to China Mobile.

It showed unusual activity in the server's error logs.