Multiple requests with identical POST parameters.

Code Injection: Usage of standard codes (like Base64) to obscure attack payloads or commands.

The IP under scrutiny has been associated with multiple modem hijackers.

It attempted to perform a man-in-the-middle attack on the SSH server.

The IP was seen trying to exploit known vulnerabilities in server software, a common tactic for gaining unauthorized access or control.

The IP attempted to use the SASL server to relay phishing emails.

A sudden spike in bandwidth usage, which can indicate a brute force attack.

The IP attempted to bypass the SASL server's authentication mechanism.

This IP was found responsible for a session hijacking attempt on our network.

The IP was caught attempting to exploit known vulnerabilities within Postfix to gain unauthorized access.

It attempted to exploit known vulnerabilities in the Mail protocol.

It attempted to send emails from the Mail server to a large number of recipients.

There were several attempts from this IP to manipulate our server DNS records.

Multiple 5xx Server Error Codes: A high count of server error status codes such as '500 Internal Server Error' may suggest an attacker is probing the server's security.

It attempted to perform a Teardrop attack on the SSH server.

It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

The malicious IP tried to brute force its way into the SASL authentication process.

This IP belongs to Cigna.

It attempted to move emails to different folders on the IMAP server without authorization.

Login Attempts with Automated User-Agents: Logs reflect requests to login page with 'bot' or 'spider' in user-agent strings.

It attempted to perform a Newtear attack on the SSH server.

It attempted to send emails from the POP3 server without authorization.

The IP attempted to download sensitive files from the Apache server.

This IP belongs to Dreamhost.

The IP under scrutiny has been associated with multiple modem hijackers.