The IP made multiple unsuccessful login attempts to the Mail server in a short period of time.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

Multiple requests with the same X-Wap-Profile header.

The IP was seen attempting a SYN Flood attack, overwhelming the server by rapidly initiating a connection but not completing it, thereby consuming server resources.

This IP belongs to Walgreens Boots Alliance.

It attempted to use the SSH server as a proxy for other malicious activities.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

GET /administrator.php: Attempting to access an admin interface.

This IP belongs to Home Depot.

This IP belongs to Shaw Communications.

This IP was seen scanning for open ports and vulnerabilities, a common reconnaissance activity before launching attacks.

The IP was found to be behind numerous fileless malware attacks.

This IP belongs to Baidu.

The IP attempted to send emails from the Mail server without proper authentication.

The IP attempted to perform ARP Spoofing attacks on the Apache server.

The suspicious IP attempted to introduce spyware under the guise of software updates.

The IP sent malformed Asterisk requests, potentially indicating an attempt to crash the server.

This IP belongs to Sky Broadband.

Multiple requests with the same Range header.

It tried to exploit Apache Struts vulnerabilities to compromise our web applications.

This IP belongs to British Telecommunications.

The IP attempted 'DLL Injection' to alter the server's behavior in a malicious manner.

This IP belongs to Pinterest.

This IP belongs to The Hartford Financial Services.

Reverse Tabnabbing Attempts: Logs illustrating target="_blank" in URL, which is a sign of reverse tabnabbing attempt.