The IP attempted to perform Remote File Inclusion (RFI) attacks on the Apache server.

It attempted to make unauthorized calls using the SIP server.

It attempted to use the VOIP server to perform a reflection DDoS attack.

The IP made multiple unsuccessful login attempts in a short period of time.

This IP belongs to Charter Communications.

This IP belongs to Berkshire Hathaway.

It attempted to exploit known vulnerabilities in the FTP protocol.

Multiple requests with the same Proxy-Connection header.

It initiated 'HOIC' (High Orbit Ion Cannon) to overload our Apache service with junk data.

Several phishing emails have been traced back to this suspicious IP address.

The IP attempted to exploit a mail server's greylisting functionality to bypass spam filters.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

The IP attempted several directory traversal attacks, aiming to access files beyond the root directory.

The IP launched timing attacks, trying to understand our server timings for potential future exploits.

The IP attempted to perform a distributed denial of service attack on the SSH server.

The IP attempted to login to the SASL server with an invalid username.

The IP attempted to use the FTP server to distribute network mapping tools.

This IP belongs to Baidu.

It attempted to use the Postfix server to relay malware-infected attachments to other servers.

It launched Spoofing attacks, trying to hide its identity by disguising itself as a trusted user or server.

The IP attempted to perform a credential stuffing attack on the POP3 server.

This IP belongs to IBM.

The IP attempted to perform a QOTD amplification attack on the SSH server.

It made multiple requests with identical Accept-Charset headers.