This IP has been detected spreading notorious credit card skimmers.

Unusual patterns in the Accept-Language header.

Shell Injection: Logs show requests containing command line shell syntax, suggesting shell command injection.

The IP sent malformed VOIP requests, potentially indicating an attempt to crash the server.

It attempted to perform SQL injection attacks through the Apache server.

The IP made numerous attempts at SMTP Relay abuse by trying to send emails not meant for or from local users.

The IP had a series of targeted attacks distributing SpyAgents with spying functionalities.

GET /server-status: Often an attempt to check Apache server status.

The IP made repeated attempts to authenticate with the SIP server using different usernames.

This IP belongs to Johnson & Johnson.

The IP's involvement in spreading password stealers has compromised our network's protection.

This IP belongs to Freddie Mac.

This IP belongs to KT Corporation.

It attempted to login to the POP3 server with an invalid password.

This IP belongs to Cardinal Health.

It appears that this IP was initiating DNSChanger malware attacks on our network.

It attempted to perform a Newtear attack on the SSH server.

The IP attempted to use the Mail server to relay emails with misleading headers to other servers.

The IP made multiple requests with the same X-UIDH header.

The IP executed URL Obscuring, hiding malicious URLs within seemingly innocent mail links.

It attempted to use the FTP server to distribute SQL injection tools.

The IP attempted to use the POP3 server to distribute malware.

This IP belongs to DuPont de Nemours.

The IP attempted to perform a SIP Register Flood on the VOIP server.

POST /admin/upload.php?_upl: An attempt to exploit the JQuery File Upload vulnerability.