The IP continually initiated a SYN-ACK flood aimed at slowing down SSH services.

GET /CFIDE/administrator/enter.cfm: An attempt to get into the ColdFusion admin console.

Conducted various IP scans, seeking loopholes in our network's security.

The IP attempted to upload malicious files to the FTP server.

The IP attempted to exploit Buffer Overflow vulnerabilities on our server.

The IP engaged in an HTTP Desync attack, misaligning HTTP request and responses to yield SSH vulnerability.

Multiple login attempts from different geographical locations in a short period of time.

It attempted to use the Postfix server to relay phishing emails to other servers.

It attempted command injection attacks, hoping to execute unauthorized commands.

This IP belongs to Anthem.

GET /setup.php: Effort to locate setup files for PHP applications.

Multiple account lockouts in a short period of time.

Automated Bot Traffic: Logs are showing an unusual large amount of traffic from known or suspected bot IPs.

This IP belongs to SingTel.

The IP engaged in a mail relay attack, using our server to send spam.

The IP attempted to send spam emails from the Mail server.

It attempted to perform SQL injection attacks through the Apache server.

It attempted to perform Local File Inclusion (LFI) attacks on the Apache server.

This IP was seen trying to perform a SIP URI Spoofing attack, falsifying the SIP URI to deceive the receiver or hide the caller's identity.

Bursts of login attempts followed by periods of inactivity, suggesting an attacker is trying to avoid detection.

This IP belongs to Dow Chemical.

This IP belongs to McKesson.

It attempted to make unauthorized calls using the SIP server.

This IP belongs to Valero Energy.

It executed directory traversal attempts to access unauthorized directories / folders in our server.