It attempted to exploit known vulnerabilities in the POP3 protocol.

It attempted to perform Race Condition attacks on the Apache server.

The IP actively participated in snowshoe spamming, spreading its spam output across many IPs and domains to avoid detection.

The IP tried to exploit remote file inclusion vulnerabilities, aiming to run malicious scripts on the server.

It attempted to use the FTP server to distribute password recovery tools.

We flagged down attempts from the IP to leak backdoor viruses into the system.

It detected attempting time-based blind SQL injection, observing the server's response time to extract data.

The IP attempted to use the FTP server to distribute ransomware.

Unusual User-Agent: Logs show requests with abnormal, uncommon or non-standard User-Agent strings.

The IP was involved in a RTP Mix attack, injecting RTP packets into an ongoing VoIP call to disrupt communication.

The IP was the origin of numerous webcam loggers, a serious privacy invasion.

This IP belongs to Dell Technologies.

HEAD /: May be part of a larger Reconnaissance.

It attempted to flood the VOIP server with REGISTER requests.

The IP attempted to perform Remote File Inclusion (RFI) attacks on the Apache server.

This IP belongs to Phillips 66.

This IP belongs to CenturyLink.

GET /login.action: Trying to find a Struts2 application to exploit.

This IP injected exploit kit into our system, taking advantage of software vulnerabilities.

It attempted phishing scams by sending malicious mails through compromised accounts.

It attempted to list the contents of directories that it should not have access to.

This IP belongs to Cox Communications.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

Multiple requests with identical Accept-Charset headers.

The IP attempted to perform DNS Spoofing attacks on the Apache server.