It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

The IP address has been involved in distributing adware to our server systems.

This IP belongs to Amazon.

The IP attempted reconnaissance activities, trying to footprint our server’s network.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

This malicious IP was reported for attempting a FTP Bounce attack, exploiting the FTP protocol's proxy command to scan ports and networks.

It attempted to perform a man-in-the-middle attack on the IMAP server.

This IP belongs to Facebook.

The IP address has been associated with unwanted browser toolbar installations.

It attempted to use the Asterisk server to perform a reflection DDoS attack.

Attempts to use privileged service accounts outside of their normal usage patterns.

The IP tried to exploit buffer overflow vulnerabilities to run unauthorized code.

It attempted to perform a credential stuffing attack on the SASL server.

This IP attempted to distribute malicious Javascript files.

Signs of CSRF Attacks: Logs demonstrating HTTP GET requests with sensitive actions that should ideally require POST requests.

It initiated the use of spambots, sending out large amounts of unsolicited mails from our server.

The IP attempted to execute unauthorized commands on the SSH server.

The IP has been distributing browser hijackers that alter the user's browsing experience without their consent.

The IP attempted to send emails from the Mail server that violate the server's terms of service.

The IP tried to manipulate DNS lookup processes to divert traffic to a malicious destination.

GET /wp-config.php~: Requesting the backup files which may expose sensitive information.

The delivery of spyware, aimed at gathering sensitive information, was originated from this IP.

This IP belongs to Vodafone.

Executed numerous SQL injection attacks in an attempt to manipulate the server's databases.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.