The said IP was the source of several rootkit deployment attempts.

It attempted to use the Asterisk server to perform a reflection DDoS attack.

The malicious IP was reported for engaging in port scanning, probing the server for open ports to discover potential vulnerabilities for exploitation.

Multiple attempts to access the server using credentials of inactive or seldom-used accounts.

Multiple requests with the same X-Requested-With header.

Multiple failed login attempts from the same IP address.

It attempted to take advantage of misconfigurations in the Apache server.

The IP was seen trying to perform a PASV FTP Bounce attack, misusing the passive mode to scan other hosts and ports.

It attempted to perform a Teardrop attack on the SSH server.

The IP attempted to perform a SIP Invite Flood on the Asterisk server.

It was discovered using our server in an open relay configuration, sending emails from unauthorized domains.

This IP belongs to Ziggo.

This IP belongs to Target.

Usage of Obscure HTTP Verbs: Seeing non-standard HTTP methods like DEBUG, PUT, or CONNECT could imply a web-based attack.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

It initiated the use of spambots, sending out large amounts of unsolicited mails from our server.

This IP belongs to Apple.

Multiple requests with the same DNT (Do Not Track) header.

Multiple account lockouts in a short period of time.

This IP belongs to Sysco.

This IP belongs to Allstate.

Multiple attempts to access the server using credentials of inactive or seldom-used accounts.

The IP attempted to perform a password spraying attack on the SASL server.

It attempted logins using outdated protocols.

HTTP Request with Large Content-Length: This could potentially indicate a buffer overflow attack where an attacker tries to crash the system by sending more data than it can handle.