Command Injection in Requests: Logs indicate HTTP requests with Unix or Windows command-line instructions.

It made multiple requests with the same X-Csrf-Token header.

The IP attempted to exploit known vulnerabilities in the Asterisk protocol.

It attempted to perform a session hijacking attack on the SSH server.

It attempted to send emails with deceptive subject lines from the Postfix server.

Unusual patterns in the sequence of requests.

The IP made multiple unsuccessful login attempts to the Postfix server in a short period of time.

GET /vuln.html: Looking for any page vulnerabilities.

This IP belongs to Shopify.

It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

It was involved in the operation of a REG-Bot, a type of bot that performs automated tasks.

This IP injected exploit kit into our system, taking advantage of software vulnerabilities.

The IP actively participated in snowshoe spamming, spreading its spam output across many IPs and domains to avoid detection.

The IP was seen attempting a FTP Command Injection attack, inserting malicious commands into legitimate FTP requests.

The IP showed unusual patterns in session IDs.

HTTP Request with Odd Timing: Very precisely timed HTTP requests could imply an automated tool or bot.

This IP had been flagged for attempting to manipulate server behaviour by injecting shellcodes.

The IP attempted a Rootkit installation to gain root access and control server activity.

It attempted to perform a credential stuffing attack on the SSH server.

This IP belongs to Berkshire Hathaway.

The malicious IP tried to brute force its way into the SASL authentication process.

The IP was found trying to maliciously clone the SSH certificates for privileged access.

A majority of our user base received phishing emails originated from this particular IP address.

It launched header-based exploits, attempting to manipulate HTTP headers to cause inappropriate server responses.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.