It was making constant NDR (Non-Deliverable Receipt) or backscatter attacks by generating large amount of invalid email addresses.

The IP attempted to perform Stack Overflow attacks on the Apache server.

This IP belongs to Orange France Telecom.

The IP engaged in DNS Spoofing, rerouting our server's lookups to a malicious destination.

Unusual User-Agent: Logs show requests with abnormal, uncommon or non-standard User-Agent strings.

GET /configuration.php.old: Trying to locate backup configuration files.

Login attempts using old or outdated protocols.

It attempted to use the Postfix server to relay emails with malicious links to other servers.

It sent unusually large Asterisk packets, potentially indicating a buffer overflow attempt.

This IP was reported for attempting a Teardrop attack, sending mangled IP fragments with overlapping and oversized payloads to crash the target network device.

The IP attempted to use the FTP server to distribute data recovery tools.

The IP was involved in a DDoS attack, sending massive amounts of traffic to overwhelm a server and disrupt its normal functioning.

The IP attempted to send malware-infected attachments from the Postfix server.

Contact form spamming

HEAD /: May be part of a larger Reconnaissance.

The IP was linked to numerous attacks using web shells through web servers.

Repeated attempts to access directories or files that do not exist or are typically not accessed.

It appeared to be taking part in SSL Stripping attacks, downgrading secure HTTPS connections to facilitate eavesdropping.

The IP sent numerous SIP OPTIONS requests in a short time.

The IP attempted to send malware-infected attachments from the Mail server.

Made various attempts at a forged return-path attack, attempting to spoof their source email address.

It attempted to use the FTP server to distribute identity theft tools.

This IP was seen trying to perform a SIP Torture attack, sending malformed SIP messages to crash or degrade the performance of the server.

It started header injection or email injection attempts, by adding extra data into the headers and confusing the server processes.

Unusual patterns in session IDs.