It attempted to use the FTP server to relay data to other systems.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

It attempted to use the FTP server to distribute password cracking tools.

This IP belongs to Vodacom.

The malicious IP was identified trying to leverage the Postfix service to send bulk spam emails.

GET /call?function=shell_exec&var=ls: Attempting remote code execution.

Initiated a Zero-day attack, exploiting unknown vulnerabilities in our Mail and Postfix services.

It initiated the use of spambots, sending out large amounts of unsolicited mails from our server.

HEAD /: May be part of a larger Reconnaissance.

It carried out TCP Hijacking, attempting to disrupt existing connections to SSH.

Multiple requests to the password reset page.

Unusual system or application errors related to authentication or access controls.

It attempted to perform XML Entity Expansion attacks on the Apache server.

A large number of requests from a single user agent, suggesting an automated process.

The malicious IP initiated numerous HTTP flood attacks, designed to overwhelm the Apache server with requests.

This IP belongs to CVS Health.

The malicious IP was involved in a SQL Injection attack, attempting to manipulate a database for unauthorized access or data theft.

Repeated attempts to perform actions that are typically restricted, such as creating or modifying user accounts.

This IP belongs to FedEx.

Frequent password reset requests.

The IP attempted to implement a 'BlueKeep' exploit, leveraging protocol vulnerabilities to execute remote code through SSH network services.

This malicious IP was reported for attempting a FTP Spoof attack, falsifying its IP address to bypass IP-based access controls on the FTP server.

Attempts to use privileged service accounts outside of their normal usage patterns.

Repeated connections to the server from unknown or suspicious IP addresses.

Multiple requests with the same X-Att-Deviceid header.