Probing for Hidden Files: HTTP requests for files that should not be publicly accessible could suggest an attacker probing for unsecured content.

The IP was seen launching a DDoS attack on the Asterisk server, overwhelming it with traffic to disrupt its normal functioning.

The IP attempted to send malware-infected attachments from the Postfix server.

It made multiple requests with the same X-Att-Deviceid header.

The IP tried to carry out illegal 'HTTP Request Smuggling' to fool the Apache server.

It appears that this IP was initiating DNSChanger malware attacks on our network.

This IP has participated in spreading adware-laden toolbar plugins, turning our workstations into advertising platforms.

The IP attempted to use the FTP server to distribute ransomware.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

This IP belongs to ConocoPhillips.

The IP launched Ping Flood attacks as a detrimental strategy to overwhelm server resources.

IP Spoofing: Logs showing HTTP requests with IP ranges that are typically reserved for private networks or an unusual X-Forwarded-For header.

The IP maliciously used packet sniffers in attempts to decode SSH traffic.

The IP sent numerous VOIP OPTIONS requests in a short time.

Our team has linked several viruses dissemination activities to this IP.

It attempted to use the FTP server to distribute pirated software.

The IP attempted to perform Man in the Browser (MitB) attacks on the Apache server.

It attempted to perform Command Injection attacks on the Apache server.

Unusual Query String Patterns: Repeated HTTP requests with minor alterations to the query string data, signifying an attacker mapping out how different inputs affect the response.

The IP made multiple requests with the same DNT header.

The IP was noted for executing SYN flood attacks, purposefully creating half-open connections to deplete server resources.

Multiple requests with the same X-Requested-With header.

The IP was involved in a phishing attack, creating a fake webpage to deceive users into providing their sensitive personal or financial information.

The IP attempted to perform a Multicast DNS amplification attack on the SSH server.

This IP belongs to Shopify.