WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.

It initiated a Phishing attack, making fake requests to the server pretending to be a legit user.

Server Side Template Injection: Suspicious input patterns aimed at coercing server-side parsers to execute injected code.

It carried out key logging attempts, hoping to record keyboard inputs during SSH sessions.

The IP address attempted to login to the FTP server with an invalid username.

HEAD /: May be part of a larger Reconnaissance.

The suspicious IP attempted to introduce spyware under the guise of software updates.

The IP tried to carry out illegal 'HTTP Request Smuggling' to fool the Apache server.

Multiple requests with the same Proxy-Authorization header.

The IP attempted to send emails from the Postfix server that violate the server's terms of service.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.

The IP attempted 'DLL Injection' to alter the server's behavior in a malicious manner.

This IP was tracked while attempting to distribute secretive and malicious keyloggers.

It attempted to login to the Postfix server with an invalid password.

It persistently tried to exploit weaknesses in the SSH communication encryption.

It attempted to perform a Sentinels amplification attack on the SSH server.

The IP attempted to send emails from the Mail server that violate the server's terms of service.

It attempted to upload malicious scripts to the Apache server.

The IP attempted to register as a SIP user with no password.

This IP belongs to General Dynamics.

Forceful Browsing: Attempts to access pages or resources without proper navigation.

A series of active scareware campaigns was traced back to this IP address.

This IP belongs to Phillips 66.

It tried to exploit Apache Struts vulnerabilities to compromise our web applications.

The IP was linked to numerous attacks using web shells through web servers.