The IP attempted to perform SOAP Injection attacks on the Apache server.

The IP made multiple requests with the same Warning header.

The IP tried creating false server responses hoping to disrupt the SASL service.

It attempted to login to the POP3 server with an invalid password.

System logs trace back the distribution of trojans that could allow for remote access to this suspicious IP.

The IP attempted to perform a replay attack on the SSH server.

The IP attempted to perform a Nestea attack on the SSH server.

This IP belongs to Amazon Web Services.

It initiated 'HOIC' (High Orbit Ion Cannon) to overload our Apache service with junk data.

The IP was seen making repeated calls to premium-rate numbers, a common form of VoIP fraud.

Side Channel Attacks: Repeated requests aimed at inferring sensitive information through observation of web responses.

This IP attempted to disrupt our systems through the propagation of worms.

The IP was involved in a RTP Bleeding attack, exploiting vulnerabilities in the VoIP server to listen to ongoing calls.

Unauthorized Access Attempts to Admin Directories: Repeated HTTP requests to known admin directories.

It attempted to perform a brute force attack on the IMAP server.

This IP belongs to Apple.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

The IP was caught attempting to execute heap overflow attacks.

The IP attempted to perform Security Misconfiguration attacks on the Apache server.

Multiple requests to the same endpoint in a short period of time.

The IP mounted HTTP Parameter Pollution attacks, disrupting server processes by injecting adulterated parameters.

The IP made multiple requests using uncommon HTTP methods.

The IP address attempted to login to the IMAP server with an invalid username.

The IP under scrutiny has been associated with multiple modem hijackers.

Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.