It carried out IP spoofing to mimic a trusted IP with the intent of gaining unauthorized SSH access.

GET /wp-config.php~: Requesting the backup files which may expose sensitive information.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

The IP attempted Forceful Browsing, trying to discover hidden directories or files which could contain SSH access data.

It attempted to delete emails from the POP3 server without authorization.

This malicious IP was reported for trying to perform a FTP Zombie Scan, using the FTP server to mask its true location and identity.

The malicious IP attempted to brute-force the .htaccess file to gain unauthorized administrative access.

The IP attempted to launch Ciphertext attacks, trying to decrypt SSH-encrypted communication.

This IP was caught distributing malicious APK files.

Purposefully tried to clog our mail server's resources by creating a mail loop configuration.

It attempted to send emails from the Mail server that violate the server's email content policy.

It attempted to perform a SIPVicious scan on the Asterisk server.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

It attempted to use the FTP server to distribute identity theft tools.

It made multiple requests with the same X-Forwarded-For header.

This IP belongs to Berkshire Hathaway.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

This IP belongs to BT Central Plus.

The IP attempted to login to the POP3 server with an invalid username.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

Attempts to login using a sequential list of passwords, indicating a possible brute force attack.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

This IP was implicated in attempts to inject ransomware into our systems.

GET /.git/config: Trying to access source code or repository configuration information.

It attempted to perform a SIP Register Flood on the SIP server.