The IP was engaged in port scanning, probing the server for open SSH ports.

The IP attempted to perform HTTP Verb Tampering attacks on the Apache server.

Made various attempts at a forged return-path attack, attempting to spoof their source email address.

It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

Unusual TCP/IP Headers: Logs reflect HTTP requests with unusual or altered TCP/IP headers, an attempt to confuse or slip through security measures.

This IP belongs to Gilead Sciences.

The IP made multiple requests with the same Via header.

Multiple requests from user agents claiming to be bots (e.g., Googlebot) that do not match known bot IP ranges.

This IP belongs to Intel.

Server Misconfiguration Exploitation: Logs illustrating attempts at exploiting known server misconfigurations.

Multiple attempts to access the server using credentials of inactive or seldom-used accounts.

The IP attempted a race condition attack, aiming to execute unwanted sequences in the server.

This IP belongs to Nike.

implemented multiple decryption attacks to gain unauthorized access to encrypted email data.

The malicious IP was reported for attempting to reroute calls through the SIP server, a tactic often used to commit toll fraud.

Actively performed packet spoofing, obscuring the origin point of its own malicious packets.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

This IP belongs to Lockheed Martin.

This IP belongs to Prudential Financial.

It attempted to perform Local File Inclusion (LFI) attacks on the Apache server.

The IP attempted to perform Man in the Browser (MitB) attacks on the Apache server.

Multiple login attempts from different geographical locations in a short period of time.

This IP belongs to Chevron.

This IP belongs to Apple.

The malicious IP was found to be running an Internet Relay Chat (IRC) bot, potentially spreading malware or launching Distributed Denial-of-Service (DDoS) attacks.