It attempted to use the Postfix server to relay phishing emails to other servers.

A sudden increase in the number of new user accounts, which can indicate an attacker has gained access and is creating backdoor accounts.

Inclusion of Binary Data in HTTP Request: If binary data is included in the HTTP request, this could suggest an attacker is attempting a binary exploit.

The IP address generated an unusual increase in network bandwidth usage.

It attempted to exploit known vulnerabilities in the SSH protocol.

The IP tried to carry out illegal 'HTTP Request Smuggling' to fool the Apache server.

Multiple requests to the same endpoint in a short period of time.

HEAD /: May be part of a larger Reconnaissance.

This IP belongs to Amazon Web Services.

This IP belongs to PythonAnywhere.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

This IP belongs to Slack.

The IP attempted to perform a timing attack on the SSH server.

It launched SQL injection attempts, to break our server database through poorly secured entry fields.

Repeated attempts to use the same password across multiple accounts.

The IP attempted to use the POP3 server to relay spam.

It attempted to login to the SSH server with an invalid password.

It tried to execute dictionary attacks on our Mail service causing potential delays.

The IP address attempted to login to the SSH server with an invalid username.

It performed botnet operations, controlling a group of “zombie” computers to amplify its DDoS attacks.

The IP has initiated several exploits, specifically for software vulnerabilities.

It attempted to use the FTP server to distribute identity theft tools.

The IP attempted to exploit known vulnerabilities in the Asterisk protocol.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

It attempted to perform a phishing attack using the POP3 server.