The IP attempted to use the FTP server to distribute forensics tools.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

The IP maliciously used packet sniffers in attempts to decode SSH traffic.

This IP belongs to Alphabet.

This IP belongs to Comcast.

GET /setup.php: Effort to locate setup files for PHP applications.

Server Side Request Forgery Attempts: Logs may show HTTP requests attempting to manipulate the server into making unintended requests.

This IP belongs to PLDT.

It persistently tried to exploit weaknesses in the SSH communication encryption.

Suspicious URL Encoding: Seeing HTTP requests with a lot of %, suggesting URL encoding to evade detection.

This IP belongs to Ford Motor.

This IP belongs to ConocoPhillips.

The IP attempted to register as a VOIP user with no password.

The IP attempted to use the Mail server to relay spam to other servers.

The IP attempted to perform a Bonk attack on the SSH server.

Repeated attempts to exploit known vulnerabilities in server software.

The IP address initiated attacks using DDoS, impacting our server response times.

Unusual Query String Patterns: Repeated HTTP requests with minor alterations to the query string data, signifying an attacker mapping out how different inputs affect the response.

The IP was recorded making persistent attempts to crack our encryption.

Our logs indicated an unusually high traffic volume originating from this IP address.

This IP belongs to Exelon.

The IP was seen trying to change the configuration settings of the Asterisk server, potentially to disable security features.

The IP sent malformed Asterisk requests, potentially indicating an attempt to crash the server.

System logs trace back the distribution of trojans that could allow for remote access to this suspicious IP.

It launched a privilege escalation attack aiming to gain unauthorized access with higher-level permissions.