Remote Execution Attempts: Logs showing unusual terminal commands or scripts run through web access.

The IP was seen attempting a FTP Command Injection attack, inserting malicious commands into legitimate FTP requests.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

The IP attempted to send emails from the Postfix server to blacklisted email addresses.

A sudden spike in bandwidth usage, which can indicate a brute force attack.

It attempted to perform a password spraying attack on the POP3 server.

The IP attempted to perform Missing Function Level Access Control attacks on the Apache server.

Automated Bot Traffic: Logs are showing an unusual large amount of traffic from known or suspected bot IPs.

The IP was reported for attempting a Cross-Site Scripting attack, injecting malicious scripts into websites to steal data or disrupt functionality.

The IP attempted to use the FTP server to distribute zero-day exploit tools.

The suspicious IP indulged in Mitnick attacks, manipulating user trust to gain confidential info.

The IP attempted to perform a phishing attack using the SASL server.

This IP belongs to Marathon Petroleum.

By leveraging the AgeTunnel software, the IP attempted to establish a covert channel across the SSH session.

It attempted to send emails from the Postfix server that violate the server's email content policy.

The IP made multiple unsuccessful login attempts to the IMAP server in a short period of time.

The IP was seen trying to perform a call transfer to an external number, a potential sign of toll fraud.

This IP belongs to The Hartford Financial Services.

This IP belongs to Virgin Media.

The IP attempted to register as an Asterisk user with no password.

It attempted to use the FTP server to distribute web proxy tools.

This IP belongs to Time Warner Cable Internet.

This IP has been linked to numerous occurrences of spyware distribution within our networks.

The IP attempted to send emails from the Postfix server that violate the server's terms of service.

The IP made repeated attempts to authenticate with the Asterisk server using different usernames.