Unusually high CPU usage, which can indicate a brute force attack is in progress.

The IP made multiple requests with the same If-Match header.

POST /upload.php: An attempt to upload a possibly malicious file.

It attempted to login to the SSH server with an invalid password.

The IP attempted to perform SOAP Injection attacks on the Apache server.

Repeated attempts to access directories or files that do not exist or are typically not accessed.

It attempted to flood the SIP server with REGISTER requests.

The IP tried to exploit buffer overflow vulnerabilities to run unauthorized code.

The IP initiated a 'Deauth' attack, knocking legitimate users off the Apache service.

This IP belongs to PLDT.

The IP was reported for attempting a Cross-Site Scripting attack, injecting malicious scripts into websites to steal data or disrupt functionality.

It attempted to flood the VOIP server with REGISTER requests.

It's observed that the IP operated a series of attacks exploiting insecure direct object references.

It tried to force its way into a secure admin session by trying to hijack the session's cookies.

It attempted mail bombing, trying to overwhelm our mail server with high volumes of email.

It attempted to perform a SYN flood attack on the SSH server.

The IP attempted to perform a distributed denial of service attack on the SSH server.

The IP attempted to send emails from the Postfix server pretending to be from a different sender.

The IP performed Covert Timing Channel attacks, gathering information about encrypted SSH traffic by analyzing packet timing.

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

It attempted to use the FTP server to relay data to other systems.

It attempted to use the FTP server to distribute brute force tools.

The IP address attempted to exploit known vulnerabilities in the Apache server software.

This IP belongs to Walmart.

Multiple requests to the server's robots.txt file.