The IP attempted to perform SOAP Injection attacks on the Apache server.

GET /trace.axd: An attempt to find a debug handler in ASP.NET.

HEAD /: May be part of a larger Reconnaissance.

This IP belongs to KDDI.

Incidents of privacy-invasive software floating in our network were linked to this IP.

Print Requests Repeatedly: Logs illustrate HTTP requests with "?print" parameter multiple times, indicating someone trying to expose sensitive information.

It was found that the IP has been exploiting zero-day vulnerabilities in our system.

Numerous incidents of botnet infestations were traced back to this offensive IP address.

The IP attempted to perform a phishing attack using the SASL server.

The IP attempted to perform a phishing attack using the SASL server.

This IP belongs to NetEase.

It showed an unusually high number of requests to the login page.

Multiple requests with the same If-Range header.

This IP was distributing rogue security software, misleading users to think their systems are infected.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

This IP belongs to Exxon Mobil.

Repeated HTTP requests with error codes, indicating failed attempts to access restricted areas.

The IP attempted to flood the Apache server with requests, in a Denial of Service (DoS) attack.

Suspicious Http Referrer Field: HTTP requests with external referrer headers that usually originate from internal source.

The IP attempted to perform a BitTorrent amplification attack on the SSH server.

The detected IP address was responsible for the distribution of botnets aimed at automating data theft.

Multiple requests with the same TE (Transfer Encoding) header.

Executed email spoofing attempts pretending to be a trusted party.

Attempts to use default or common usernames and passwords, a common tactic in brute force attacks.

This IP belongs to KDDI.