The IP attempted to perform Session Fixation attacks on the Apache server.

The IP attempted to use the FTP server to distribute anonymizing tools.

Tried to carry out a rainbow table attack, attempting to crack hashed passwords.

This IP belongs to DigitalOcean.

This IP was seen trying to perform a RTP Injection attack, inserting audio into an established VoIP call.

It attempted to exploit known vulnerabilities in the Postfix software.

The IP was involved in a SIP Message Tampering attack, altering SIP messages in transit to disrupt communication or gain unauthorized access.

It made multiple requests with the same X-Wap-Profile header.

Multiple login attempts from different geographical locations in a short period of time.

This IP belongs to TELUS Communications.

GET /administrator.php: Attempting to access an admin interface.

Suspicious Http Referrer Field: HTTP requests with external referrer headers that usually originate from internal source.

The malicious IP attempted to brute-force the .htaccess file to gain unauthorized administrative access.

Unusual network traffic patterns, such as a high amount of outbound traffic.

This IP was involved in deploying stealthy credential stealers in our network.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

The IP was traced back to stealthy installation attempts of clipboard monitors.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

Too Many HTTP GET Requests: An unusually high number of HTTP GET requests from a single IP or a small set of IPs could indicate a DoS attack.

This IP belongs to McKesson.

The malicious IP was involved in a credential stuffing attack, using stolen username-password combinations to gain unauthorized access.

The IP was seen attempting a FTP Smurf attack, flooding the FTP server with echo request packets to cause a denial of service.

The IP attempted to send emails from the Mail server to blacklisted email addresses.

The IP attempted to perform Session Fixation attacks on the Apache server.

It appears this IP was linked to a number of drive-by-download attacks, silently downloading spyware.