It partook in location spoofing, making it appear from different locations.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

It attempted to perform a Sentinels amplification attack on the SSH server.

It tried to execute Privilege Escalation attacks, trying to gain higher-level access on our server.

The IP made multiple unsuccessful login attempts to the IMAP server in a short period of time.

It attempted to use the POP3 server to relay phishing emails.

Repeated failed attempts to access application interfaces or ports that are typically not open to the public.

The IP distributed unrequested software, secretly stealing user data while posing as useful tools.

A sudden increase in the number of new user accounts, which can indicate an attacker has gained access and is creating backdoor accounts.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.

The IP attempted to use the FTP server to distribute VPN tools.

Repeated failed attempts to perform actions that require higher privileges.

Attempts to access sensitive areas of the server, such as the admin page or user account information.

The malicious IP was suspected of cryptojacking, illicitly using others' computing resources to mine cryptocurrencies.

The IP address attempted to login to the IMAP server with an invalid username.

The IP attempted to perform a phishing attack using the SASL server.

It attempted to login to the Postfix server with an invalid password.

This IP belongs to Wells Fargo.

The IP actively tried code replacement attacks, swapping legitimate system call addresses with malicious ones.

This IP belongs to AT&T.

Too Many Request Timeouts: An abnormal amount of request timeouts might suggest an ongoing Slowloris attack.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

Remote File Inclusion (RFI): You might see HTTP requests with "=http" or "=ftp" which can signal an attempt for remote file inclusion.

This IP belongs to Medium.

GET /.git/config: Trying to access source code or repository configuration information.