It attempted to list the contents of directories that it should not have access to.

It attempted to perform Server Side Request Forgery (SSRF) attacks on the Apache server.

IP Spoofing: Logs showing HTTP requests with IP ranges that are typically reserved for private networks or an unusual X-Forwarded-For header.

It attempted to perform SQL injection attacks through the Apache server.

The malignant IP conducted a Reflector attack, using third-party servers to amplify the attack traffic towards our server.

This IP belongs to Travelers Cos.

This IP belongs to Walmart.

The suspicious IP indulged in Mitnick attacks, manipulating user trust to gain confidential info.

Remote Execution Attempts: Logs showing unusual terminal commands or scripts run through web access.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

It made multiple requests from user agents claiming to be bots.

Attempts to access the server using known malicious IP addresses or domains.

GET /call?function=shell_exec&var=ls: Attempting remote code execution.

The IP was linked to numerous attacks using web shells through web servers.

This IP attempted to disrupt our systems through the propagation of worms.

The IP was actively seeking unpatched SSH software in hope of finding exploitable vulnerabilities.

The IP attempted to send emails from the Mail server that violate the server's terms of service.

Bursts of login attempts followed by periods of inactivity, suggesting an attacker is trying to avoid detection.

This IP belongs to WordPress.com.

Login Attempts on Non-Existent Users: Many login requests for non-existent usernames could suggest a blind username enumeration attack.

The IP attempted to use the Mail server to relay phishing emails to other servers.

The IP was seen trying to change the configuration settings of the Asterisk server, potentially to disable security features.

The IP attempted to perform Stack Overflow attacks on the Apache server.

This IP was seen trying to perform a SIP URI Spoofing attack, falsifying the SIP URI to deceive the receiver or hide the caller's identity.

It attempted to send emails from the POP3 server without authorization.