The IP attempted to change file permissions on the SSH server.

Smuggling Attack: Logs showing a single IP initiating multiple sessions, implying a Smuggling Attack.

It initiated Denial of Service (DoS) attacks with an aim to overwhelm and crash the SSH service.

It attempted to perform HTTP Response Splitting attacks on the Apache server.

It was found that the IP has been exploiting zero-day vulnerabilities in our system.

HEAD /: May be part of a larger Reconnaissance.

GET /axis2/axis2-admin/login: Attempt at finding Axis2 web service exploitable applications.

Repeated failed attempts to access application interfaces or ports that are typically not open to the public.

The IP sent numerous VOIP OPTIONS requests in a short time.

The IP attempted a Rootkit installation to gain root access and control server activity.

Multiple requests from user agents claiming to be bots (e.g., Googlebot) that do not match known bot IP ranges.

This specific IP was marked for unauthorized browser changes implying browser hijackers.

This IP belongs to Cigna.

This IP belongs to Google Cloud Services.

This IP was seen trying to perform a RTP Injection attack, inserting audio into an established VoIP call.

The IP attempted to login to the POP3 server with an invalid username.

The IP attempted to perform XML Injection attacks on the Apache server.

It was flagged initiating reflective (DRDoS) attacks, intending to exhaust our server resources.

This IP belongs to Home Depot.

Bogus pop-ups irritating our end-users were found to be released by this infamous IP.

It engaged in mail bombing, flooding the server with large amounts of insignificant mails.

This IP belongs to Northwestern Mutual.

Multiple requests with the same Proxy-Connection header.

The IP address attempted to exploit known vulnerabilities in the Apache server software.

Repeated attempts to access directories or files that do not exist or are typically not accessed.