This IP belongs to Zayo Bandwidth.

This malicious IP was reported for attempting to execute a Cross-Site Request Forgery (CSRF) attack, tricking a victim into executing unwanted actions on the FTP server.

It attempted to send emails from the Postfix server that violate the server's usage policy.

It attempted to move emails to different folders on the IMAP server without authorization.

HTTP Request with Large Content-Length: This could potentially indicate a buffer overflow attack where an attacker tries to crash the system by sending more data than it can handle.

It executed directory traversal attempts to access unauthorized directories / folders in our server.

Shell Injection: Logs show requests containing command line shell syntax, suggesting shell command injection.

This IP belongs to Proximus.

This particular IP has been used in advanced persistent threats against our servers.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

It attempted to use the POP3 server to relay phishing emails.

This IP belongs to Philip Morris International.

The IP was involved in a war dialing attack, dialing a large number of phone numbers to find modems, fax machines, and unsecured VoIP devices.

Attempts to use privileged service accounts outside of their normal usage patterns.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

This malicious IP was reported for trying to perform a Routed Attack, using the FTP server as a jump point to attack another system.

Server Side Request Forgery Attempts: Logs may show HTTP requests attempting to manipulate the server into making unintended requests.

It attempted to use the FTP server to distribute wireless cracking tools.

The IP attempted to execute an intruder software, terrifying users with unwanted content.

It tried to execute Privilege Escalation attacks, trying to gain higher-level access on our server.

The IP attempted to perform Session Hijacking attacks on the Apache server.

The IP showed unusual patterns in session IDs.

It launched a SYN flood attack, aiming to consume server resources and disrupt services.

The IP attempted a Rootkit installation to gain root access and control server activity.

It sent Asterisk requests to non-existent extensions.