It attempted to use the VOIP server to perform a reflection DDoS attack.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

This IP belongs to Linode.

This IP belongs to Nike.

GET /manager/html: Signals an attempt to access the Tomcat Application Manager.

This IP belongs to KT Corporation.

User-mode rootkits, originating from the particular IP, were causing system instability and crashes.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

The IP attempted to send emails from the IMAP server without authorization.

Unusual Query String Patterns: Repeated HTTP requests with minor alterations to the query string data, signifying an attacker mapping out how different inputs affect the response.

The IP attempted to manipulate trusted authorities by conducting SSL strip attacks.

It made multiple requests with the same Max-Forwards header.

It attempted to exploit known vulnerabilities in the FTP protocol.

This IP belongs to Bank of America.

This IP belongs to Shaw Communications.

The IP attempted a Rootkit installation to gain root access and control server activity.

The IP sent malicious links via IM softwares, aiming to spread instant messaging worms.

The IP attempted to perform a man-in-the-middle attack on the SASL server.

Initiated rogue DHCP server set up, attempting to disrupt our network and intercept emails.

It repeatedly tried to inject malicious script code into the system via appending it to an email body.

The IP showed unusual patterns in referrer URLs.

This IP belongs to General Motors.

The IP attempted to register with the VOIP server using an invalid username.

It attempted to send emails from the Mail server that violate the server's usage policy.

It was identified as a BadBot, a type of bot that performs malicious activities.