Multiple requests to the password reset page.

The IP sent malicious links via IM softwares, aiming to spread instant messaging worms.

Multiple requests with identical Accept-Encoding headers.

The IP attempted logins at unusual times.

It attempted to upload malicious scripts to the Apache server.

The IP attempted to perform XML Injection attacks on the Apache server.

This IP belongs to Comcast.

SQL Injection in HTTP Requests: Logs record HTTP requests that contain SQL statements. Possible strings could include 'SELECT *' or 'DROP TABLE', indicative of a SQL injection attack.

This IP belongs to T-Mobile.

The IP was seen trying to exploit known vulnerabilities in the Asterisk server, a common tactic for gaining unauthorized access or control.

A multitude of spyware-infected download wrappers were linked to the spotted IP address.

The IP attempted to download emails from the IMAP server without authorization.

The IP address attempted delivering malicious packets to disrupt the system's operation.

Multiple requests with identical Accept-Encoding headers.

The IP sent numerous SIP OPTIONS requests in a short time.

It attempted to send emails from the Postfix server to email addresses that have previously marked emails from the server as spam.

The IP was involved in distributing malware, infecting systems or networks to steal data, cause damage, or gain unauthorized access.

This IP belongs to TIAA.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

The IP attempted to send malware-infected attachments from the Mail server.

This IP belongs to World Fuel Services.

The IP engaged in a mail relay attack, using our server to send spam.

Multiple requests with identical request parameters.

It appears this IP was linked to a number of drive-by-download attacks, silently downloading spyware.

The IP under scrutiny has been associated with multiple modem hijackers.