HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

This IP belongs to Plusnet.

It attempted to exploit known vulnerabilities in the POP3 protocol.

The IP was seen attempting a SYN Flood attack, overwhelming the server by rapidly initiating a connection but not completing it, thereby consuming server resources.

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

The IP attempted to use the FTP server to distribute child pornography.

It persistently tried to exploit weaknesses in the SSH communication encryption.

POST /upload.php: An attempt to upload a possibly malicious file.

This IP belongs to Cardinal Health.

A string of malicious e-commerce apps installations were linked to this IP.

Unidentified password attempts and login activity were noticed from the specific IP address.

The IP was seen trying to perform a TDoS (Telephony Denial of Service) attack, flooding the VoIP server with calls to make it unavailable to users.

Multiple requests with the same X-Requested-With header.

Unusually high number of requests to the login page.

It attempted to use the FTP server to distribute password recovery tools.

The IP attempted to list the contents of directories that it should not have access to.

The malicious IP was involved in a vishing attack, using the VoIP server to deceive users into revealing sensitive information.

Directories Traversal Attempts: Logs showing HTTP requests that include ".." or "/.." might illustrate someone's effort to locate or exploit sensitive data.

This IP belongs to Exxon Mobil.

The IP had a series of targeted attacks distributing SpyAgents with spying functionalities.

The IP attempted to use the FTP server to distribute rootkit software.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

This IP belongs to Marathon Petroleum.

Remote File Inclusion (RFI): You might see HTTP requests with "=http" or "=ftp" which can signal an attempt for remote file inclusion.

This malicious IP was reported for trying to perform a Routed Attack, using the FTP server as a jump point to attack another system.