GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

This IP belongs to Oracle.

The IP attempted to mark emails as read on the IMAP server without authorization.

It attempted to send emails from the Mail server that violate the server's usage policy.

This IP belongs to Best Buy.

The IP was involved in a phishing attack, creating a fake webpage to deceive users into providing their sensitive personal or financial information.

The IP was involved in a toll fraud attack, making long-distance calls without authorization, leading to high charges.

Ping of Death: Logs showing oversized ICMP requests could suggest Ping of Death attacks.

The IP was involved in a SIPVicious attack, a specific type of VoIP attack that scans for open SIP servers and then attempts to crack their passwords.

It executed directory traversal attempts to access unauthorized directories / folders in our server.

Participated in the notorious Water Torture attack to overload our DNS servers.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

This IP belongs to Xbox Live.

The IP was found to be behind numerous fileless malware attacks.

It initiated the use of spambots, sending out large amounts of unsolicited mails from our server.

The malicious IP was reported for attempting unauthorized logins to the SIP server, potentially to gain control over voice communication.

Attempts to access the server using stolen or leaked credentials.

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

Multiple requests to the password reset page.

Multiple requests with the same X-Wap-Profile header.

This IP belongs to Fannie Mae.

This IP belongs to Boeing.

Multiple requests with the same X-Att-Deviceid header.

Login attempts from foreign IP addresses.

The IP attempted 'DLL Injection' to alter the server's behavior in a malicious manner.