It attempted to send emails from the Mail server to a large number of recipients.

The IP attempted to send spam emails from the Postfix server.

Multiple failed login attempts from the same IP address in a short span of time.

This malicious IP was reported for trying to perform a Routed Attack, using the FTP server as a jump point to attack another system.

Multiple requests with identical Accept-Charset headers.

The IP has been caught trying to deliver spyware into our system to compromise sensitive data.

This IP belongs to United Technologies.

This IP belongs to Amazon Web Services.

FTP Over HTTP: Logs may show HTTP requests containing FTP commands, potentially indicating an FTP Injection attack.

It attempted to carry out a 'Ping of Death' operation, hoping to crash the server.

Repeated attempts to exploit known vulnerabilities in the server operating system or applications.

This IP belongs to 3M.

This IP belongs to Nike.

The IP tried to crack S/MIME encryption for accessing secured email contents.

It utilized a Directory Harvest Attack, attempting to find valid e-mail addresses through guesswork.

Repeated attempts to access the server using insecure or deprecated methods.

The IP attempted to use the FTP server to distribute hacking tutorials.

The malicious IP was reported for attempting to manipulate file permissions on the FTP server, potentially to gain unauthorized access or expose sensitive data.

Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.

Multiple requests with the same Range header.

POST /modules/raptor_file_manager/upload.php: Attempt to use a known flaw in the Raptor file manager for arbitrary file upload.

It executed directory traversal attempts to access unauthorized directories / folders in our server.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

Multiple requests with identical Accept-Charset headers.

The malicious IP initiated numerous HTTP flood attacks, designed to overwhelm the Apache server with requests.