It attempted to perform Command Injection attacks on the Apache server.

This IP belongs to The Hartford Financial Services.

It attempted command injection attacks, hoping to execute unauthorized commands.

It attempted to exploit known vulnerabilities in the SASL protocol.

The IP attempted to use the FTP server to distribute DDoS attack tools.

The IP attempted to send emails with misleading headers from the Postfix server.

It attempted phishing scams by sending malicious mails through compromised accounts.

Content Sniffing: Logs reflect HTTP requests that include the Accept header with " / ", suggesting an attacker is trying to detect what types of content the server will send.

This particular IP has been used in advanced persistent threats against our servers.

The IP was involved in a Ping of Death attack, sending packets larger than the maximum allowed size, causing the system to freeze or crash.

It attempted to perform Clickjacking attacks on the Apache server.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

It attempted mail bombing, trying to overwhelm our mail server with high volumes of email.

It attempted to login to the FTP server with an invalid password.

It sent SIP INVITE requests to non-existent extensions.

This IP belongs to PLDT.

GET /db/finance.dump: An attempt to access a database dump file.

This IP belongs to UnitedHealth Group.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

The IP attempted various header manipulation attacks, aiming to bypass spam filters.

The IP was seen launching a DDoS attack on the Asterisk server, overwhelming it with traffic to disrupt its normal functioning.

It executed directory traversal attempts to access unauthorized directories / folders in our server.

It's observed that the IP operated a series of attacks exploiting insecure direct object references.

The IP was involved in a SIP Message Tampering attack, altering SIP messages in transit to disrupt communication or gain unauthorized access.