It was found actively trying to exploit HTTP Response Splitting vulnerabilities to perform further attacks.

The IP was seen trying to upload files to the FTP server, possibly with the intent of distributing malware.

It attempted to exploit known vulnerabilities in the SSH protocol.

The IP attempted a race condition attack, aiming to execute unwanted sequences in the server.

The IP initiated IP spoofing, fooling our systems to trust its malicious communication.

It was observed attempting to conduct a replay attack, resending captured SSH packets in hopes of session hijacking.

Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

The IP attempted to perform Remote File Inclusion (RFI) attacks on the Apache server.

It attempted to send phishing emails from the Mail server.

It continually sought to exploit known vulnerabilities within SSH through crafted packet attempts.

It executed directory traversal attempts to access unauthorized directories / folders in our server.

Unknown IP Address: An unfamiliar IP address making frequent requests could imply a compromised machine.

The IP initiated dictionary attacks, hoping to guess the correct password combination.

A sudden increase in the number of new user accounts, which can indicate an attacker has gained access and is creating backdoor accounts.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

This IP belongs to UnitedHealth Group.

This IP belongs to British Telecommunications.

This IP belongs to BT Central Plus.

The IP was seen engaging in a Slowloris attack, holding as many connections to the target web server open for as long as possible, eventually overloading the server.

This IP injected exploit kit into our system, taking advantage of software vulnerabilities.

This IP belongs to Hong Kong Broadband Network.

Unauthorized Access Attempts to Admin Directories: Repeated HTTP requests to known admin directories.

Multiple requests with the same X-Forwarded-For header.

The malignant IP conducted a Reflector attack, using third-party servers to amplify the attack traffic towards our server.

This IP belongs to United Technologies.