GET /login.action: Trying to find a Struts2 application to exploit.

It was involved in a Distributed Denial of Service (DDoS) attack.

This IP belongs to Comcast.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

It attempted to send emails with malicious links from the Postfix server.

This IP belongs to CVS Health.

The IP was involved in a SIP brute force attack, attempting to guess SIP authentication credentials to gain unauthorized access.

This IP belongs to Netflix.

The IP initiated a 'Deauth' attack, knocking legitimate users off the Apache service.

GET /configuration.php.old: Trying to locate backup configuration files.

Several instances of password stealers were traced back to this notorious IP.

It attempted to take advantage of misconfigurations in the Apache server.

The IP attempted to perform Man in the Browser (MitB) attacks on the Apache server.

This IP belongs to Marathon Petroleum.

The IP sent numerous SIP OPTIONS requests in a short time.

The IP attempted to perform XML External Entity (XXE) attacks on the Apache server.

Too Many HTTP 404 Errors: A high number of 404 Page Not Found errors may indicate an attacker trying to find valid directories or pages.

This IP belongs to Optus.

It attempted to exploit known vulnerabilities in the Mail protocol.

The IP used a 'Poodle' attack in attempts to downgrade the server's SSL to a more vulnerable state.

The IP attempted a pass-the-hash attack, trying to authenticate without knowing the plaintext password.

The IP attempted to send emails from the Postfix server without proper authentication.

The IP attempted to use the FTP server to distribute spam.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

GET /call?function=shell_exec&var=ls: Attempting remote code execution.