The IP attempted to use the FTP server to distribute anonymizing tools.

The IP attempted to implement a 'BlueKeep' exploit, leveraging protocol vulnerabilities to execute remote code through SSH network services.

The IP sent numerous Asterisk OPTIONS requests in a short time.

Frequent access requests from user agents that are known to be associated with malicious tools or bots.

Multiple requests with the same X-Csrf-Token header.

Attempts to login using a sequential list of passwords, indicating a possible brute force attack.

The IP was seen trying to exploit known vulnerabilities in the Asterisk server, a common tactic for gaining unauthorized access or control.

The IP attempted to inject malicious scripts into the server hoping it would get executed.

The IP attempted to use the FTP server to distribute spam.

This IP belongs to Microsoft Azure.

This IP belongs to Google Cloud Services.

An alarming frequency of microphone loggers has been traced back to this IP.

We discovered attempts from the IP to install rootkit spyware to gain control over our systems.

Our system flagged this IP as conducting fraudulent transactions activities.

This malicious IP was reported for trying to perform a FTP Zombie Scan, using the FTP server to mask its true location and identity.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

This IP has been flagged for attempting to escalate privileges in our network.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

The IP attempted to perform DNS Spoofing attacks on the Apache server.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

The IP continually initiated a SYN-ACK flood aimed at slowing down SSH services.

The IP used a 'Poodle' attack in attempts to downgrade the server's SSL to a more vulnerable state.

The IP attempted session sidejacking, seeking to take over SSH sessions post-authentication.

The IP's involvement in spreading password stealers has compromised our network's protection.

The IP was involved in a war dialing attack, dialing a large number of phone numbers to find modems, fax machines, and unsecured VoIP devices.