The IP was seen launching a DDoS attack on the FTP server, overwhelming it with traffic to disrupt its normal functioning.

Multiple login attempts using common or easily guessable passwords (like 'password123', 'admin', etc.).

Repeated failed attempts to access application interfaces or ports that are typically not open to the public.

A sudden surge in the number of requests per second, indicating an automated process.

Multiple login attempts with slight variations in the password, suggesting a dictionary attack, a type of brute force attack.

Unusual increase in network bandwidth usage.

Multiple failed login attempts from the same IP address in a short span of time.

The IP attempted to send spam emails from the Postfix server.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

The IP address attempted to register as a SIP user with an invalid username.

The IP attempted to delete files from the FTP server.

The IP attempted to use the FTP server to distribute zero-day exploit tools.

GET /ELMAH.axd: Attempting to exploit ELMAH (Error Logging Modules and Handlers) misconfiguration in ASP.NET sites.

Multiple requests with the same Proxy-Authorization header.

This IP belongs to Facebook.

It performed 'Spectre' attacks, exploiting predictive branching in CPUs to potentially gain sensitive information from the SSH service.

The IP attempted to perform a dictionary attack on the IMAP server.

It attempted to use the Asterisk server to perform a reflection DDoS attack.

The IP attempted the notorious Shellshock vulnerability, which could pose a severe threat to our server's resources.

It attempted to use the FTP server to distribute network scanning tools.

This IP belongs to Ford Motor.

It exploited insecure server configurations and attempted to establish reverse SSH tunneling.

The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

The IP was observed participating in Social Engineering attacks to manipulate individuals into revealing SSH login details.

The IP was recorded making persistent attempts to crack our encryption.