It attempted to perform Session Sidejacking attacks on the Apache server.

This IP belongs to Heroku.

It attempted to send phishing emails from the Mail server.

This IP belongs to Dell Technologies.

GET /call?function=shell_exec&var=ls: Attempting remote code execution.

This IP belongs to Costco Wholesale.

Too Many HTTP GET Requests: An unusually high number of HTTP GET requests from a single IP or a small set of IPs could indicate a DoS attack.

This IP belongs to Phillips 66.

This IP belongs to Sysco.

It tried to execute Privilege Escalation attacks, trying to gain higher-level access on our server.

It made multiple requests with the same If-None-Match header.

This IP belongs to Walgreens Boots Alliance.

GET /trace.axd: An attempt to find a debug handler in ASP.NET.

The IP attempted to use the FTP server to distribute network mapping tools.

This IP belongs to Oracle.

The IP attempted to send spam emails from the Postfix server.

This malicious IP was reported for trying to perform a Symlink attack, creating symbolic links to files outside the FTP server's root directory.

GET /../htpasswd: Trying to access password files using directory traversal.

The IP was seen performing a CSRF (Cross-site request forgery) attack to manipulate user actions.

Attempts to use privileged service accounts outside of their normal usage patterns.

It attempted to use the FTP server to distribute network scanning tools.

It attempted to perform WSDL Enumeration attacks on the Apache server.

It attempted to send emails from the Mail server that violate the server's acceptable use policy.

It attempted to perform a brute force attack on the POP3 server.

Print Requests Repeatedly: Logs illustrate HTTP requests with "?print" parameter multiple times, indicating someone trying to expose sensitive information.