It made successive tries to alter SMTP relay configurations to send unsolicited emails.

The IP was seen engaging in a Slowloris attack, holding as many connections to the target web server open for as long as possible, eventually overloading the server.

This IP belongs to MTS (Mobile TeleSystems).

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

It attempted to login to the POP3 server with an invalid password.

The IP attempted to send emails from the Mail server to blacklisted email addresses.

This IP belongs to Amazon.

The IP sent numerous VOIP OPTIONS requests in a short time.

Multiple requests with the same Origin header.

This IP belongs to State Farm Insurance.

The IP initiated a 'Deauth' attack, knocking legitimate users off the Apache service.

It attempted to perform SQL injection attacks through the Apache server.

It attempted to use the Asterisk server as a relay for calls to premium-rate numbers.

Unknown source code changes in our system were linked back to this offensive IP address.

A large number of requests from a single user agent, suggesting an automated process.

Multiple requests with identical request parameters.

It attempted to list the contents of directories that it should not have access to.

Unwanted Web Crawler Activity: Observing unusual frequent requests from a known web crawler not granted to scan your site.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

It attempted to perform a password spraying attack on the POP3 server.

Unusual patterns in referrer URLs.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

It tried to execute a Rainbow Table attack, aiming to break the encryption used in SSH password protection.

Initiated a Zero-day attack, exploiting unknown vulnerabilities in our Mail and Postfix services.

Damaging activities showing connections to rootkit attacks were associated with this IP.