The IP was seen trying to exploit known vulnerabilities in the Asterisk server, a common tactic for gaining unauthorized access or control.

GET /../htpasswd: Trying to access password files using directory traversal.

It attempted to perform Cross-Site Request Forgery (CSRF) attacks through the Apache server.

GET /index.php?param=: Attempting a cross-site scripting (XSS) attack.

It attempted to use the SASL server to relay spam.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

Multiple requests with the same X-Requested-With header.

Initiated a Zero-day attack, exploiting unknown vulnerabilities in our Mail and Postfix services.

GET /internal/: Browsing an internal directory.

The IP set off alarms for an attempted man-in-the-middle attack on our servers.

This IP was detected uploading malicious codes in our network.

This IP belongs to Deutsche Telecom.

It attempted zero-day attacks, exploiting unknown vulnerabilities in pop3.

The IP performed regular system foot printing to gain intel on weak points in our server.

It attempted to list the contents of directories that it should not have access to.

This malicious IP was reported for attempting to download files from the FTP server without authorization, potentially stealing sensitive data.

This IP belongs to Orange France Telecom.

Multiple HTTP 401 Status Codes: This could indicate someone is repeatedly attempting to access resources that require valid credentials, possibly attempting to brute-force their way in.

It attempted to carry out a dictionary attack on pop3 logins to gain unauthorized access.

The IP was involved in a Ping of Death attack, sending packets larger than the maximum allowed size, causing the system to freeze or crash.

Distributed session hijackers from the IP were designed to capture and exploit web browser sessions.

The IP initiated clickjacking exploits, causing users to unwittingly perform malicious actions during SSH sessions.

It was making constant NDR (Non-Deliverable Receipt) or backscatter attacks by generating large amount of invalid email addresses.

This malicious IP was reported for attempting to perform a FTP Port Stealing attack, hijacking the data connection of an existing FTP session.