It attempted to perform HTTP Response Splitting attacks on the Apache server.

Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.

The IP attempted to perform HTTP Request Smuggling attacks on the Apache server.

System logs have traced multiple cases of our servers being bombed with trojans to this IP.

It made multiple requests with identical cookies.

This IP belongs to Tyson Foods.

This IP belongs to Cloudfare.

The IP attempted to exploit known vulnerabilities in the VOIP protocol.

We noticed the IP attempting to compromise our IoT devices by spreading IoT malware.

The IP sent numerous VOIP OPTIONS requests in a short time.

The IP attempted to use the SASL server to relay phishing emails.

GET /index.php?param=: Attempting a cross-site scripting (XSS) attack.

The IP made multiple requests with the same TE header.

GET /administrator.php: Attempting to access an admin interface.

The IP attempted to send spam emails from the Mail server.

The IP attempted to perform a replay attack on the POP3 server.

This IP has been marked as the origin of numerous SQL injection attacks.

This IP belongs to Telkom SA.

Attempts to login using a sequential list of passwords, indicating a possible brute force attack.

Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

It attempted to perform a phishing attack using the POP3 server.

This IP belongs to Korea Telecom.

This IP belongs to PepsiCo.

The IP sent numerous Asterisk OPTIONS requests in a short time.

The IP address made multiple attempts to exploit a Remote File Inclusion (RFI) vulnerability.