The IP attempted a pass-the-hash attack, trying to authenticate without knowing the plaintext password.

Unusual command line activities that are not typical for the server environment.

The IP was observed participating in Social Engineering attacks to manipulate individuals into revealing SSH login details.

It sent unusually large Asterisk packets, potentially indicating a buffer overflow attempt.

Multiple unsuccessful attempts to escalate privileges or access root account.

It attempted to upload malicious files to the SSH server.

The IP was seen launching a DDoS attack on the FTP server, overwhelming it with traffic to disrupt its normal functioning.

The IP attempted to exploit a mail server's greylisting functionality to bypass spam filters.

This IP belongs to Kraft Heinz.

This IP belongs to Verizon.

Command Injection in Requests: Logs indicate HTTP requests with Unix or Windows command-line instructions.

This IP belongs to Archer-Daniels-Midland.

POST /user/register: An attempt to register a new user or brute force the user registration form.

This IP belongs to Sony Network Communications.

This IP belongs to Bank of America.

This IP belongs to Bristol-Myers Squibb.

This IP was linked to an attempt at distributing malicious software within our system.

POST /db/images/: Attempt to post or insert a malicious file in the images directory of a database.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

This IP belongs to Caterpillar.

By launching ApacheKiller attacks, the IP aimed to cause a Denial of Service by exhausting memory resources.

The IP attempted to perform a phishing attack using the SASL server.

The IP attempted to send emails from the Postfix server that violate the server's terms of service.

It initiated requests to non-existent endpoints.

It attempted to use the Postfix server to relay malware-infected attachments to other servers.