Repeated attempts to access the server using insecure or deprecated methods.

The IP attempted to use the Mail server to relay malware-infected attachments to other servers.

The IP performed Covert Timing Channel attacks, gathering information about encrypted SSH traffic by analyzing packet timing.

This IP belongs to Microsoft.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

This IP belongs to Gilead Sciences.

It attempted to perform Command Injection attacks on the Apache server.

The IP attempted to use the FTP server to distribute forensics tools.

Multiple failed login attempts from the same IP address in a short span of time.

The IP attempted to use the Mail server to relay phishing emails to other servers.

This IP belongs to Swisscom.

This IP belongs to Abbott Laboratories.

It showed unusual activity in the server's error logs.

Finally, the IP was caught in the act of Abandoned Object attacks, creating objects with no reference to exhaust memory space

The IP attempted to perform XML External Entity (XXE) attacks on the Apache server.

It was observed attempting to conduct a replay attack, resending captured SSH packets in hopes of session hijacking.

The IP was seen trying to perform a FTP Reflection attack, using the FTP server to amplify its DDoS attack traffic.

It attempted to perform Clickjacking attacks on the Apache server.

Multiple login attempts from different geographical locations in a short period of time.

The IP's involvement in spreading password stealers has compromised our network's protection.

It attempted to perform Man in the Middle (MitM) attacks on the Apache server.

A series of unusual file transfers originated from this IP.

Multiple requests with the same Warning header.

The malicious IP was involved in a credential stuffing attack, using stolen username-password combinations to gain unauthorized access.

The IP made multiple unsuccessful login attempts to the Postfix server in a short period of time.