The IP made numerous attempts at SMTP Relay abuse by trying to send emails not meant for or from local users.

It attempted to perform a side channel attack on the SSH server.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.

This IP belongs to Sysco.

The IP attempted to perform XML Injection attacks on the Apache server.

POST /xmlrpc.php: Could indicate an attempt at exploiting the WordPress xmlrpc.php file, often used for brute forcing.

The IP attempted various header manipulation attacks, aiming to bypass spam filters.

The IP made repeated attempts to authenticate with the Asterisk server using different usernames.

The IP was seen trying to perform a FTP Reflection attack, using the FTP server to amplify its DDoS attack traffic.

It attempted to send emails from the POP3 server without authorization.

The IP attempted to use the FTP server to distribute forensics tools.

Unusual increase in network bandwidth usage.

It attempted to send emails with deceptive subject lines from the Mail server.

Inclusion of Binary Data in HTTP Request: If binary data is included in the HTTP request, this could suggest an attacker is attempting a binary exploit.

It attempted to perform HTTP Response Splitting attacks on the Apache server.

The IP was seen traffic sniffing, trying to spy on and analyse network packets for potential server vulnerabilities.

This IP belongs to Optus.

The malignant IP conducted a Reflector attack, using third-party servers to amplify the attack traffic towards our server.

This IP belongs to Telstra.

The IP made multiple requests with the same TE header.

The IP attempted to send emails from the Mail server to blacklisted email addresses.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

The IP was involved in a war dialing attack, dialing a large number of phone numbers to find modems, fax machines, and unsecured VoIP devices.

Attempts to access the server using outdated or insecure protocols, which can indicate an attacker is trying to exploit known vulnerabilities.

It was flagged that this IP had been used in conducting method tampering on our servers.