It showed an unusually high number of requests to the login page.

Multiple requests with the same Origin header.

Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

It was discovered using our server in an open relay configuration, sending emails from unauthorized domains.

This IP belongs to Marathon Petroleum.

The malicious IP tried to depreciate the reputation of our mail server by sending out numerous spam mails.

The malicious IP tried to brute force its way into the SASL authentication process.

This IP belongs to SK Broadband.

This IP belongs to Hostgator.

It sent unusually large VOIP packets, potentially indicating a buffer overflow attempt.

Our records indicate the IP spread multiple executable infector spyware causing system malfunction.

The malicious IP was reported for attempting a RTP Replay attack, capturing RTP packets and resending them to disrupt communication.

The malicious IP initiated numerous HTTP flood attacks, designed to overwhelm the Apache server with requests.

This IP belongs to AmerisourceBergen.

Forceful Browsing: Attempts to access pages or resources without proper navigation.

It attempted to perform a phishing attack using the IMAP server.

Rapid sequence of login attempts.

Multiple failed attempts to use the server’s API.

This IP belongs to Walgreens Boots Alliance.

Code Injection: Usage of standard codes (like Base64) to obscure attack payloads or commands.

Unusual TCP/IP Headers: Logs reflect HTTP requests with unusual or altered TCP/IP headers, an attempt to confuse or slip through security measures.

The IP was flagged trying to conduct Denial of Service (DoS) attacks on the Postfix service.

This IP belongs to Time Warner Cable Internet.

This IP belongs to Home Depot.

This IP belongs to SK Broadband.