It sent unusually large VOIP packets, potentially indicating a buffer overflow attempt.

With the introduction of hidden malicious intent, this IP found to be operating masked redirect attacks.

the IP made attempts at wiretapping the network to monitor SSH traffic patterns and gather useful information.

It attempted to exploit known vulnerabilities in the POP3 protocol.

A sudden increase in the number of new user accounts, which can indicate an attacker has gained access and is creating backdoor accounts.

It attempted to use the VOIP server to perform a reflection DDoS attack.

The IP was part of an IRC-Bot network, a type of botnet that uses the Internet Relay Chat (IRC) protocol.

It launched a privilege escalation attack aiming to gain unauthorized access with higher-level permissions.

The IP attempted fileless malware attacks, directly injecting malicious script into server memory.

This IP belongs to Bank of America.

It made multiple requests from user agents claiming to be bots.

It attempted to make unauthorized calls using the SIP server.

This IP belongs to Tyson Foods.

It attempted to send emails from the Mail server to a large number of recipients.

The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

It attempted to use the SASL server to distribute malware.

Repeated failed attempts to access application interfaces or ports that are typically not open to the public.

This IP belongs to TELUS Communications.

By launching ApacheKiller attacks, the IP aimed to cause a Denial of Service by exhausting memory resources.

TLS Downgrade Attacks: Logs showing repeated attempts to establish non-TLS connections with the server.

The IP attempted to send emails from the Postfix server that violate the server's terms of service.

Remote Execution Attempts: Logs showing unusual terminal commands or scripts run through web access.

Multiple attempts to access the server using credentials that were previously compromised in a data breach.

GET /modules/productpageadverts/uploadimage.php: This is related to a known vulnerability in the Prestashop module productpageadverts.

The IP attempted to perform a Bonk attack on the SSH server.