Attempted to conduct numerous data harvesting strategies to gather sensitive user data.

GET /wp-login.php: Indicating an attempt to access a WordPress login page.

Multiple failed login attempts from the same IP address.

The IP attempted to perform a NetBIOS amplification attack on the SSH server.

We linked the IP to numerous attacks using RM adware, causing regular system interruptions.

Initiated rogue DHCP server set up, attempting to disrupt our network and intercept emails.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

This malicious IP was reported for trying to perform a FTP Zombie Scan, using the FTP server to mask its true location and identity.

It attempted to send emails from the Postfix server that violate the server's email content policy.

The IP address made multiple attempts to exploit a Remote File Inclusion (RFI) vulnerability.

This malicious IP was reported for attempting a Smurf attack, flooding a target system via spoofed broadcast ping messages.

This IP belongs to Deutsche Telecom.

It attempted to take advantage of misconfigurations in the Apache server.

Several cross-site scripting attacks were traced back to this IP.

The IP attempted to perform XML External Entity (XXE) attacks on the Apache server.

Multiple Requests from Different IPs with Same User-Agent: This could be a signal of a coordinated attack originating from compromised machines.

The IP was seen trying to exploit known vulnerabilities in server software, a common tactic for gaining unauthorized access or control.

It established numerous 'doppelganger' domains to mimic our SSH server, aiming to trick users into revealing sensitive data.

It attempted to perform a man-in-the-middle attack on the IMAP server.

It attempted to use the FTP server to distribute virus creation tools.

Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

Attempts to use privileged service accounts outside of their normal usage patterns.

The IP made multiple unsuccessful login attempts to the SASL server in a short period of time.

The IP attempted to login to the Postfix server with an invalid username.

The IP was linked to numerous attacks using web shells through web servers.