A sudden increase in the number of new user accounts, which can indicate an attacker has gained access and is creating backdoor accounts.

It sought to exploit cross-site scripting (XSS) vulnerabilities within our mail service web interface.

It attempted to perform a Sentinels amplification attack on the SSH server.

Last night, we received an alert regarding this IP attempting to upload keyloggers to our network.

The malicious IP attempted to exploit server misconfigurations to gain higher-level access.

It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

It engaged in mail bombing, flooding the server with large amounts of insignificant mails.

This IP belongs to SK Broadband.

This IP belongs to Optus.

It attempted to perform a Quake Network Protocol amplification attack on the SSH server.

Content Sniffing: Logs reflect HTTP requests that include the Accept header with " / ", suggesting an attacker is trying to detect what types of content the server will send.

The IP has initiated several exploits, specifically for software vulnerabilities.

The IP was marked attempting to use infamous 'Ramnit' malware to steal sensitive Apache server data.

This IP belongs to Tech Data.

The IP address initiated multiple unsuccessful login attempts.

Attempts to access the server using outdated or insecure protocols, which can indicate an attacker is trying to exploit known vulnerabilities.

The IP attempted to use the FTP server to distribute anonymizing tools.

Repeated attempts to access the server using old or outdated software versions, which might have known vulnerabilities.

Inclusion of Binary Data in HTTP Request: If binary data is included in the HTTP request, this could suggest an attacker is attempting a binary exploit.

It attempted to perform Session Prediction attacks on the Apache server.

The IP attempted to send malware-infected attachments from the Mail server.

The identified IP address was involved in planting backdoor programs that give excessive control over infected systems.

The IP was part of an IRC-Bot network, a type of botnet that uses the Internet Relay Chat (IRC) protocol.

It engaged in a click fraud operation using our server’s communication channels.