It attempted to use the POP3 server to relay phishing emails.

It made multiple requests with the same X-Att-Deviceid header.

It initiated the use of spambots, sending out large amounts of unsolicited mails from our server.

It sent unusually large VOIP packets, potentially indicating a buffer overflow attempt.

The IP was seen trying to perform a Fraggle attack, a type of DDoS attack where the attacker sends a large amount of UDP traffic to a router's broadcast network.

It attempted to delete emails from the IMAP server without authorization.

This IP belongs to PepsiCo.

Multiple failed login attempts from the same IP address in a short span of time.

The IP made multiple requests with the same DNT header.

This IP belongs to Vkontakte.

This malicious IP was reported for attempting to perform a FTP Phishing attack, creating a fake FTP login page to deceive users into providing their credentials.

It attempted to perform a man-in-the-middle attack on the POP3 server.

The malicious IP initiated numerous HTTP flood attacks, designed to overwhelm the Apache server with requests.

This IP was associated with targeted spear phishing attempts against our senior staff.

Multiple requests with identical Accept-Charset headers.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

It executed directory traversal attempts to access unauthorized directories / folders in our server.

It attempted to use the FTP server to distribute virus creation tools.

POST /modules/raptor_file_manager/upload.php: Attempt to use a known flaw in the Raptor file manager for arbitrary file upload.

Multiple requests with the same Range header.

A majority of our user base received phishing emails originated from this particular IP address.

It tried to use the email server for bounce spam, of sending out spam to third parties with forged return paths.

Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.

It attempted to send emails from the Postfix server to email addresses that have previously marked emails from the server as spam.

The malicious IP was reported for attempting to manipulate file permissions on the FTP server, potentially to gain unauthorized access or expose sensitive data.