It attempted to perform Man in the Middle (MitM) attacks on the Apache server.

The malicious IP was identified trying to leverage the Postfix service to send bulk spam emails.

This IP belongs to ConocoPhillips.

It was found that the IP had deployed rogue security software in our system.

It launched a SYN flood attack, aiming to consume server resources and disrupt services.

This IP belongs to Johnson & Johnson.

The IP address has been associated with unwanted browser toolbar installations.

It was caught injecting malicious code into the SSH session attempting to compromise server integrity.

The IP performed regular system foot printing to gain intel on weak points in our server.

A high number of unsuccessful SSH logins, a common target for brute force attacks.

The IP tried to manipulate DNS lookup processes to divert traffic to a malicious destination.

This IP belongs to Caterpillar.

The IP was involved in a SIP Flooding attack, sending a large number of SIP messages in a short period to overwhelm the server.

POST /admin/upload.php?_upl: An attempt to exploit the JQuery File Upload vulnerability.

The IP address generated an unusual increase in network bandwidth usage.

POST /upload.php: An attempt to upload a possibly malicious file.

The IP conducted exhaustive dictionary attacks, trying to guess password and username combinations.

Command Injection in Requests: Logs indicate HTTP requests with Unix or Windows command-line instructions.

This IP belongs to Walgreens Boots Alliance.

Multiple requests with identical POST parameters.

The IP attempted to list the contents of directories that it should not have access to.

This IP belongs to Alphabet.

The IP made multiple unsuccessful login attempts to the IMAP server in a short period of time.

Ping of Death: Logs showing oversized ICMP requests could suggest Ping of Death attacks.

It attempted to send emails from the Postfix server that violate the server's usage policy.