It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

This IP belongs to Amazon.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

This IP belongs to Facebook.

It attempted to use the Asterisk server to perform a reflection DDoS attack.

Attempts to use privileged service accounts outside of their normal usage patterns.

The IP tried to exploit buffer overflow vulnerabilities to run unauthorized code.

It attempted to perform a credential stuffing attack on the SASL server.

This IP attempted to distribute malicious Javascript files.

Signs of CSRF Attacks: Logs demonstrating HTTP GET requests with sensitive actions that should ideally require POST requests.

It initiated the use of spambots, sending out large amounts of unsolicited mails from our server.

The IP attempted to execute unauthorized commands on the SSH server.

The IP has been distributing browser hijackers that alter the user's browsing experience without their consent.

The IP attempted to send emails from the Mail server that violate the server's terms of service.

The IP tried to manipulate DNS lookup processes to divert traffic to a malicious destination.

GET /wp-config.php~: Requesting the backup files which may expose sensitive information.

The delivery of spyware, aimed at gathering sensitive information, was originated from this IP.

This IP belongs to Vodafone.

Executed numerous SQL injection attacks in an attempt to manipulate the server's databases.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

It was identified as a BadBot, a type of bot that performs malicious activities.

This IP belongs to Canadian Department of Defense.

It attempted to send emails from the Mail server that violate the server's usage policy.

This IP belongs to America Movil.

The malicious IP engaged in distributed denial of service (DDoS) attacks, exhausting server resources and disrupting SSH services.