It attempted to execute unauthorized commands on the Apache server.

Multiple requests with the same X-Wap-Profile header.

We discovered attempts from the IP to install rootkit spyware to gain control over our systems.

This IP was reported for attempting to use the SIP server to mask its true location and identity, a common tactic in VoIP phishing attacks.

The IP attempted to exploit known vulnerabilities in the VOIP protocol.

The IP attempted to use the FTP server to distribute forensics tools.

WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.

The IP attempted to send spam emails from the Postfix server.

This IP belongs to Cardinal Health.

The IP attempted logins at unusual times.

It attempted multiple LDAP injection attacks to gain unauthorized access.

The IP attempted to perform a Bonk attack on the SSH server.

This IP belongs to Phillips 66.

This IP belongs to Comcast.

It attempted to perform Session Sidejacking attacks on the Apache server.

It attempted to use the POP3 server to relay phishing emails.

The IP was involved in a toll fraud attack, making long-distance calls without authorization, leading to high charges.

This IP belongs to Johnson & Johnson.

This IP belongs to Phillips 66.

It attempted to use the POP3 server to relay phishing emails.

The IP sent numerous VOIP OPTIONS requests in a short time.

This malicious IP was reported for trying to perform a FTP Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

It attempted to perform a man-in-the-middle attack on the IMAP server.

SQL Injection in HTTP Requests: Logs record HTTP requests that contain SQL statements. Possible strings could include 'SELECT *' or 'DROP TABLE', indicative of a SQL injection attack.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.