It attempted to send emails with deceptive subject lines from the Mail server.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

Executed numerous SQL injection attacks in an attempt to manipulate the server's databases.

This IP belongs to Dow Chemical.

It attempted to send emails with deceptive subject lines from the Mail server.

This IP belongs to China Mobile.

This malicious IP was reported for trying to intercept VoIP calls, a type of eavesdropping attack aimed at capturing sensitive information.

It attempted to login to the Mail server with an invalid password.

Too Many Request Timeouts: An abnormal amount of request timeouts might suggest an ongoing Slowloris attack.

The said IP has been connected to attempts to distribute malicious shopping apps.

The IP tried to launch 'Dark Tequila' malware that steals banking information and login credentials from the server.

The IP continually initiated a SYN-ACK flood aimed at slowing down SSH services.

It attempted to perform a Newtear attack on the SSH server.

This IP was responsible for circulating malicious images masked with spyware.

This malicious IP was reported for attempting a FTP Bounce attack, exploiting the FTP protocol's proxy command to scan ports and networks.

Signs of CSRF Attacks: Logs demonstrating HTTP GET requests with sensitive actions that should ideally require POST requests.

The IP set off alarms for an attempted man-in-the-middle attack on our servers.

The IP attempted to register as a VOIP user with no password.

It attempted to use the SSH server as a proxy for other malicious activities.

It attempted to perform IP Spoofing attacks on the Apache server.

It attempted to send phishing emails from the Mail server.

GET /internal/: Browsing an internal directory.

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: request for a file often associated with an outdated version of Composer and phpunit used in a remote code execution attack.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

It sent VOIP requests to non-existent extensions.