It attempted to send emails with malicious links from the Postfix server.

IP Spoofing: Logs showing HTTP requests with IP ranges that are typically reserved for private networks or an unusual X-Forwarded-For header.

Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.

Malicious Script Execution: Execution attempts of suspicious scripts or encoded payloads often seen in URI parameters or request bodies.

This IP belongs to PythonAnywhere.

This IP belongs to Exxon Mobil.

This IP belongs to CHS.

The IP attempted to send emails from the Mail server that violate the server's email sending limits.

udden increase in account lockouts due to multiple failed login attempts.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

It attempted to perform a Teardrop attack on the SSH server.

It made multiple requests with the same X-Forwarded-For header.

GET /modules/productpageadverts/uploadimage.php: This is related to a known vulnerability in the Prestashop module productpageadverts.

The IP attempted to perform Format String attacks on the Apache server.

The IP showed unusual patterns in referrer URLs.

Too Many Request Timeouts: An abnormal amount of request timeouts might suggest an ongoing Slowloris attack.

The IP attempted to perform a key exchange attack on the SSH server.

The IP address has been linked to the creation of artificial traffic to crash our website.

Unusual TCP/IP Headers: Logs reflect HTTP requests with unusual or altered TCP/IP headers, an attempt to confuse or slip through security measures.

This IP belongs to Allstate.

This IP was traced back to several attempts to access domain admin credentials.

The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

The IP's involvement in spreading password stealers has compromised our network's protection.

It attempted to perform a Smurf attack on the SSH server.

The IP attempted to perform a dictionary attack on the IMAP server.