The IP attempted to perform DNS Spoofing attacks on the Apache server.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

The IP tried to initiate DNS tunneling for smuggling data through SSH.

Our system logs indicate this IP has been pushing illegitimate browser plugins into our network.

It attempted to send emails from the Postfix server to email addresses that have previously marked emails from the server as spam.

This IP belongs to Cloudfare.

DNS changer spyware originating from the flagged IP was designed to redirect our network traffic.

Server Misconfiguration Exploitation: Logs illustrating attempts at exploiting known server misconfigurations.

The IP attempted to use the Mail server to relay emails with misleading headers to other servers.

The IP attempted to manipulate data flowing to the server to cause arbitrary code execution.

The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

POST /j_security_check: May indicate an attempt to bypass Java server page (JSP) login mechanisms.

The handler of this IP has been exploiting scumware to disrupt our users' browsing experience.

This malicious IP was reported for trying to perform a Symlink attack, creating symbolic links to files outside the FTP server's root directory.

It attempted to use the SASL server to distribute malware.

This IP belongs to Freddie Mac.

It systematically tried to exploit IMAP and POP3 vulnerabilities present in our mail service setup.

This IP belongs to The Walt Disney Company.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

The IP attempted to send emails from the Postfix server to blacklisted email addresses.

Unusually high CPU usage, which can indicate a brute force attack is in progress.

The IP made multiple requests using uncommon HTTP methods.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

This IP belongs to The Hartford Financial Services.

Our team discovered that specific IP was distributing intrusive cookie trackers.