It sent VOIP requests to non-existent extensions.

The IP attempted to perform Cross-Site Scripting (XSS) attacks through the Apache server.

It launched Spoofing attacks, trying to hide its identity by disguising itself as a trusted user or server.

This IP was seen trying to perform a SIP URI Spoofing attack, falsifying the SIP URI to deceive the receiver or hide the caller's identity.

It attempted to use the FTP server to distribute phishing emails.

The IP initiated a 'Deauth' attack, knocking legitimate users off the Apache service.

It appears this IP was linked to a number of drive-by-download attacks, silently downloading spyware.

By leveraging the AgeTunnel software, the IP attempted to establish a covert channel across the SSH session.

Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.

Multiple login attempts using different usernames, suggesting an attacker is trying to guess the correct username/password combination.

This IP belongs to Deutsche Telecom.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

GET /wp-config.php~: Requesting the backup files which may expose sensitive information.

It attempted to perform a session hijacking attack on the SSH server.

This IP belongs to World Fuel Services.

The IP attempted to send emails with misleading headers from the Postfix server.

It attempted to perform Race Condition attacks on the Apache server.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

The IP initiated a 'Deauth' attack, knocking legitimate users off the Apache service.

This IP belongs to IBM Cloud Services.

Numerous requests for non-existent pages, suggesting the attacker is probing for vulnerabilities.

It systematically tried to exploit IMAP and POP3 vulnerabilities present in our mail service setup.

This malicious IP was reported for attempting to initiate a large number of simultaneous calls, a sign of a potential DDoS attack.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

This malicious IP attempted a brute force attack, trying to crack login credentials to gain unauthorized access to a system or account.