The IP showed unusual patterns in session IDs.

The IP attempted to perform Missing Function Level Access Control attacks on the Apache server.

It attempted to perform a password spraying attack on the POP3 server.

It attempted to perform a denial of service attack on the SSH server.

The IP made multiple requests to the password reset page.

This IP belongs to OVH.

The malicious IP initiated unauthorized Mail Queue access attempts, impacting mail service efficiency.

The IP made multiple requests with identical Accept-Encoding headers.

The malicious IP attempted to brute-force the .htaccess file to gain unauthorized administrative access.

This IP was reported for attempting to register a large number of SIP extensions in a short time, a sign of a potential brute force attack.

Identification of Known Vulnerabilities: Attempts to exploit known vulnerabilities related to your server application.

It attempted to perform Uncontrolled Format String attacks on the Apache server.

The IP attempted to perform SOAP Injection attacks on the Apache server.

The IP was involved in a Caller ID Spoofing attack, falsifying the caller ID to deceive the receiver or hide the caller's identity.

Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.

The malicious IP was reported for engaging in port scanning, probing the server for open ports to discover potential vulnerabilities for exploitation.

Path/File Enumeration: Logs show multiple HTTP requests to non-existing pages and incrementing filenames, suggesting file or path enumeration.

A sudden surge in the number of requests per second, indicating an automated process.

It attempted mail bombing, trying to overwhelm our mail server with high volumes of email.

It attempted to perform SQL injection attacks through the Apache server.

The IP attempted to exploit a mail server's greylisting functionality to bypass spam filters.

The IP attempted session sidejacking, seeking to take over SSH sessions post-authentication.

Damaging activities showing connections to rootkit attacks were associated with this IP.

It attempted to use the FTP server to store illegal content.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.