It repeatedly tried to inject malicious script code into the system via appending it to an email body.

Suspicious URL Encoding: Seeing HTTP requests with a lot of %, suggesting URL encoding to evade detection.

This IP belongs to Wells Fargo.

The IP attempted to send emails from the Postfix server without proper authentication.

The IP was observed participating in Social Engineering attacks to manipulate individuals into revealing SSH login details.

This malicious IP was reported for attempting to download files from the FTP server without authorization, potentially stealing sensitive data.

It attempted to perform a SIP Register Flood on the SIP server.

Purposefully tried to clog our mail server's resources by creating a mail loop configuration.

It was discovered illicitly scanning the server for potential vulnerabilities.

GET /modules/productpageadverts/uploadimage.php: This is related to a known vulnerability in the Prestashop module productpageadverts.

Participated in a botnet attack to overwhelm our server’s resources.

The IP was involved in a FTP Flood attack, sending a large number of FTP connection requests to overwhelm the server.

The IP attempted to use the FTP server to distribute ransomware.

The IP made multiple requests to the password reset page.

It initiated Denial of Service (DoS) attacks with an aim to overwhelm and crash the SSH service.

Unusual increase in network bandwidth usage.

It attempted to perform a SIP Register Flood on the Asterisk server.

It attempted to perform Command Injection attacks on the Apache server.

It tried to execute Privilege Escalation attacks, trying to gain higher-level access on our server.

The IP address has been involved in distributing adware to our server systems.

The IP attempted to perform Integer Overflow attacks on the Apache server.

Multiple login attempts with slight variations in the password, suggesting a dictionary attack, a type of brute force attack.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

Conducted various IP scans, seeking loopholes in our network's security.