It attempted to list the contents of directories that it should not have access to.

It made multiple requests with the same X-Att-Deviceid header.

It attempted to perform XML Entity Expansion attacks on the Apache server.

Frequent access requests from user agents that are known to be associated with malicious tools or bots.

The IP sought to exploit the SSH-1 CRC32 vulnerability for expansive unauthorized access.

Shell Injection: Logs show requests containing command line shell syntax, suggesting shell command injection.

It attempted to use the Asterisk server as a relay for calls to premium-rate numbers.

The IP attempted to delete directories on the SSH server.

The IP was observed participating in Social Engineering attacks to manipulate individuals into revealing SSH login details.

The IP was involved in a toll fraud attack, making long-distance calls without authorization, leading to high charges.

It attempted to send emails with deceptive subject lines from the Mail server.

The IP was marked trying to carry out Backscatter spam by replying to spam using the server's configuration.

Unusual User-Agent: Logs show requests with abnormal, uncommon or non-standard User-Agent strings.

This IP belongs to Humana.

Participated in the notorious Water Torture attack to overload our DNS servers.

The IP was seen trying to perform a Denial of Service (DoS) attack, attempting to make a machine or network resource unavailable to its intended users.

the IP made attempts at wiretapping the network to monitor SSH traffic patterns and gather useful information.

It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

The IP attempted to use the Mail server to relay spam to other servers.

It attempted to send emails from the Mail server to email addresses that have previously marked emails from the server as spam.

Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

The IP was involved in a rapid sequence of login attempts.

It attempted to perform a man-in-the-middle attack on the IMAP server.

The IP attempted to perform a brute force attack on the SSH server.

It attempted to perform Race Condition attacks on the Apache server.