GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

Login attempts using old or outdated protocols.

This IP belongs to Alibaba Cloud Services.

Command Injection in Requests: Logs indicate HTTP requests with Unix or Windows command-line instructions.

This IP belongs to Boeing.

This IP belongs to Walgreens Boots Alliance.

It attempted to use the FTP server to distribute password recovery tools.

The IP attempted to download emails from the IMAP server without authorization.

This malicious IP was reported for attempting a Sniffing attack, capturing and analyzing FTP traffic to glean sensitive information.

The IP was seen attempting a Dictionary attack on the FTP server, systematically entering every word in a dictionary as a password to find the correct one.

Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.

The malicious IP was reported for attempting unauthorized logins to the SIP server, potentially to gain control over voice communication.

The IP attempted to perform HTTP Verb Tampering attacks on the Apache server.

The IP attempted to perform a dictionary attack on the POP3 server.

The IP made multiple unsuccessful login attempts to the Postfix server in a short period of time.

This IP belongs to BT Central Plus.

This IP belongs to UnitedHealth Group.

The IP attempted to use the FTP server to distribute child pornography.

The IP initiated dictionary attacks, hoping to guess the correct password combination.

It attempted to perform a Newtear attack on the SSH server.

The IP attempted to perform Remote File Inclusion (RFI) attacks on the Apache server.

The IP was marked trying to carry out Backscatter spam by replying to spam using the server's configuration.

The IP attempted logins at unusual times.

This IP belongs to UnitedHealth Group.

It attempted to send emails from the Mail server to email addresses that have previously marked emails from the server as spam.