It attempted to use the FTP server to distribute SQL injection tools.

GET /axis2/axis2-admin/login: Attempt at finding Axis2 web service exploitable applications.

It attempted to perform WSDL Enumeration attacks on the Apache server.

Actively performed packet spoofing, obscuring the origin point of its own malicious packets.

It made multiple requests with identical POST parameters.

The IP maliciously used packet sniffers in attempts to decode SSH traffic.

It carried out IP spoofing to mimic a trusted IP with the intent of gaining unauthorized SSH access.

We linked the IP to numerous attacks using RM adware, causing regular system interruptions.

Malformed Host Headers: HTTP requests with host headers that do not match the site's actual hostname.

It attempted to perform a NTP amplification attack on the SSH server.

It attempted to send emails from the Mail server that violate the server's usage policy.

The IP was engaged in email append attacks, trying to add addresses to an existing email or response mid-transit.

It was flagged that this IP had been used in conducting method tampering on our servers.

The malicious IP initiated unauthorized Mail Queue access attempts, impacting mail service efficiency.

The IP attempted a Rootkit installation to gain root access and control server activity.

The IP tried to carry out illegal 'HTTP Request Smuggling' to fool the Apache server.

This IP belongs to Linode.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

The IP attempted to use the FTP server to distribute steganography tools.

Multiple login attempts using common or easily guessable passwords (like 'password123', 'admin', etc.).

It attempted to use the FTP server to distribute pirated software.

It attempted to perform Session Sidejacking attacks on the Apache server.

It attempted to use the VOIP server to perform a reflection DDoS attack.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.