The IP was caught attempting to execute heap overflow attacks.

It attempted to perform XML Entity Expansion attacks on the Apache server.

Forceful Browsing: Attempts to access pages or resources without proper navigation.

It attempted to perform a SIPVicious scan on the Asterisk server.

Multiple requests from user agents claiming to be bots (e.g., Googlebot) that do not match known bot IP ranges.

It attempted to exploit known vulnerabilities in the Postfix software.

The IP attempted to use the Mail server to relay malware-infected attachments to other servers.

Incidents of privacy-invasive software floating in our network were linked to this IP.

This malicious IP was reported for attempting to perform a FTP Phishing attack, creating a fake FTP login page to deceive users into providing their credentials.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.

This IP belongs to General Motors.

GET /configuration.php.old: Trying to locate backup configuration files.

This IP belongs to Target.

GET /server-status: Often an attempt to check Apache server status.

It actively sought to exploit unpatched software within our server applications.

Repeated pings or probe requests to the server, indicating a potential reconnaissance effort before the attack.

Frequent access requests from user agents that are known to be associated with malicious tools or bots.

SQL Injection in HTTP Requests: Logs record HTTP requests that contain SQL statements. Possible strings could include 'SELECT *' or 'DROP TABLE', indicative of a SQL injection attack.

GET /setup.php: Effort to locate setup files for PHP applications.

The IP was flagged for attempting dictionary attacks on our user accounts.

The IP was involved in a FTP Spam attack, using the FTP server to distribute unsolicited emails or messages.

It repetitively attempted Port Scanning to identify open ports and related vulnerabilities.

It initiated SSL-Stripping attacks, aiming to downgrade secure HTTPS connections to less-secure HTTP.

This malicious IP was reported for trying to exploit known vulnerabilities in the FTP server software, potentially to gain control over the server.

The IP was observed participating in Social Engineering attacks to manipulate individuals into revealing SSH login details.