It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

This IP belongs to Exelon.

Login attempts at unusual times (e.g., in the middle of the night).

This IP belongs to AT&T.

Rapid sequence of login attempts.

Participated in a botnet attack to overwhelm our server’s resources.

It attempted mail bombing, trying to overwhelm our mail server with high volumes of email.

It attempted to perform a brute force attack on the IMAP server.

Unusually high number of requests to the login page.

The IP was caught distributing VoIP crackers to exploit our communication channels.

It attempted zero-day attacks, exploiting unknown vulnerabilities in pop3.

Server Side Template Injection: Suspicious input patterns aimed at coercing server-side parsers to execute injected code.

Multiple unsuccessful attempts to escalate privileges or access root account.

It's observed that the IP operated a series of attacks exploiting insecure direct object references.

Multiple requests with identical Accept-Encoding headers.

The IP tried to exploit remote file inclusion vulnerabilities, aiming to run malicious scripts on the server.

This IP belongs to Proximus.

The IP attempted to download emails from the IMAP server without authorization.

The IP attempted to use the SASL server to relay phishing emails.

GET /server-status: Often an attempt to check Apache server status.

The IP attempted to exploit known vulnerabilities in the Asterisk protocol.

It attempted to send emails from the Mail server that violate the server's acceptable use policy.

This IP belongs to Baidu.

The IP was involved in a Directory Traversal attack on the FTP server, attempting to access restricted directories and files.

GET /wp-config.php~: Requesting the backup files which may expose sensitive information.