It attempted to use the SASL server to relay spam.

It attempted to perform a dictionary attack on the SASL server.

The IP attempted to use the FTP server to distribute DDoS attack tools.

This IP belongs to Shaw Communications.

The malicious IP was found trying to exploit the IMAP 'unselect' vulnerability.

It attempted to use the FTP server to distribute traffic monitoring tools.

This IP belongs to Proximus.

POST /ckupload.php,: A threat actor attempting to exploit CKEditor’s file uploader.

This IP belongs to NetEase.

Unusual network traffic patterns, such as a high amount of outbound traffic.

User-mode rootkits, originating from the particular IP, were causing system instability and crashes.

The IP was noticed spreading RATs (remote administration tools) camouflaged as regular software.

HTTP Request with Large Content-Length: This could potentially indicate a buffer overflow attack where an attacker tries to crash the system by sending more data than it can handle.

Actively performed packet spoofing, obscuring the origin point of its own malicious packets.

The IP made multiple requests with the same Proxy-Authorization header.

GET /db/finance.dump: An attempt to access a database dump file.

It attempted to use the Postfix server to relay emails with misleading headers to other servers.

GET /wp-login.php: Indicating an attempt to access a WordPress login page.

This IP belongs to NetEase.

This IP belongs to UnitedHealth Group.

Too Many HTTP GET Requests: An unusually high number of HTTP GET requests from a single IP or a small set of IPs could indicate a DoS attack.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

The IP attempted to change file permissions on the SSH server.

It was involved in a Distributed Denial of Service (DDoS) attack.

Unusual network traffic patterns, such as a high amount of outbound traffic.