The IP address made multiple attempts to exploit a Remote File Inclusion (RFI) vulnerability.

The IP attempted to use the POP3 server to relay spam.

It attempted to perform a Smurf attack on the SSH server.

It attempted to flood the SIP server with REGISTER requests.

It attempted to perform Session Sidejacking attacks on the Apache server.

The IP mounted HTTP Parameter Pollution attacks, disrupting server processes by injecting adulterated parameters.

Unusual increase in server CPU usage.

Automated Bot Traffic: Logs are showing an unusual large amount of traffic from known or suspected bot IPs.

It attempted to make unauthorized calls using the SIP server.

It attempted to perform a session hijacking attack on the SSH server.

This IP belongs to American Express.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

The said IP has been connected to attempts to distribute malicious shopping apps.

The identified IP address was involved in planting backdoor programs that give excessive control over infected systems.

Attempts to access the server using known malicious IP addresses or domains.

This malicious IP was reported for trying to perform a Man-in-the-Middle attack, intercepting and potentially altering communication between the FTP server and its clients.

This IP belongs to CVS Health.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

It attempted to use the FTP server to relay data to other systems.

The IP attempted to perform a DNS amplification attack on the SSH server.

This IP belongs to IBM Cloud Services.

It attempted to make unauthorized calls using the Asterisk server.

The IP sent numerous Asterisk OPTIONS requests in a short time.

This IP belongs to AT&T.

It attempted to perform a man-in-the-middle attack on the POP3 server.