This IP belongs to MetLife.

Multiple requests with the same X-Wap-Profile header.

This IP belongs to AT&T.

The IP attempted to send emails with misleading headers from the Postfix server.

It repeatedly tried to inject malicious script code into the system via appending it to an email body.

HTTP Request with Odd Timing: Very precisely timed HTTP requests could imply an automated tool or bot.

The IP attempted to perform a credential stuffing attack on the POP3 server.

This IP belongs to Ford Motor.

It attempted to perform a SIPVicious scan on the Asterisk server.

This IP belongs to Archer-Daniels-Midland.

This IP belongs to Comcast.

The IP address attempted to login to the IMAP server with an invalid username.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

The IP attempted to use the FTP server to distribute anonymizing tools.

The IP had been flagged for initiating SYN flood attacks on our servers.

It attempted to perform a side channel attack on the SSH server.

The IP executed URL Obscuring, hiding malicious URLs within seemingly innocent mail links.

The deceptive IP was sneaking in spyware through clickjacking attacks to manipulate our users.

Multiple attempts to access the server using different ports or protocols.

The malicious IP attempted to exploit server misconfigurations to gain higher-level access.

It actively sought to exploit unpatched software within our server applications.

The malicious IP tried to brute force its way into the SASL authentication process.

Attempts to access the server using stolen or leaked credentials.

Initiated rogue DHCP server set up, attempting to disrupt our network and intercept emails.