It attempted to perform a SIPVicious scan on the Asterisk server.

It carried out key logging attempts, hoping to record keyboard inputs during SSH sessions.

The IP attempted to send emails from the Postfix server to blacklisted email addresses.

This IP belongs to Morgan Stanley.

System logs have traced multiple cases of our servers being bombed with trojans to this IP.

Multiple 5xx Server Error Codes: A high count of server error status codes such as '500 Internal Server Error' may suggest an attacker is probing the server's security.

This malicious IP was reported for trying to exploit known vulnerabilities in the FTP server software, potentially to gain control over the server.

High Frequency POST Requests: Numerous or unusual POST requests in a short time span could indicate a dictionary or brute force attack on a login page.

The IP was involved in a FTP Spam attack, using the FTP server to distribute unsolicited emails or messages.

The IP attempted to register with the VOIP server using an invalid username.

POST /upload.php: An attempt to upload a possibly malicious file.

It attempted to login to the Postfix server with an invalid password.

Code Injection: Usage of standard codes (like Base64) to obscure attack payloads or commands.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

It attempted to perform WSDL Enumeration attacks on the Apache server.

It attempted to perform a SIP Invite Flood on the VOIP server.

The IP made multiple requests with identical Accept-Encoding headers.

This IP belongs to NetEase.

The IP attempted to use the Mail server to relay malware-infected attachments to other servers.

It attempted to use the Postfix server to relay malware-infected attachments to other servers.

The IP made multiple unsuccessful login attempts in a short period of time.

Attempts to access sensitive areas of the server, such as the admin page or user account information.

It sent VOIP requests to non-existent extensions.

The malicious IP was seen trying to perform a Replay attack, capturing SIP authentication data and resending it to gain unauthorized access.

GET /CFIDE/administrator/enter.cfm: An attempt to get into the ColdFusion admin console.