It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

A string of malicious e-commerce apps installations were linked to this IP.

The malicious IP initiated numerous HTTP flood attacks, designed to overwhelm the Apache server with requests.

This IP belongs to GitHub.

This IP belongs to Exelon.

GET /login.action: Trying to find a Struts2 application to exploit.

The IP attempted to use the FTP server as a proxy for other malicious activities.

The IP was found trying to maliciously clone the SSH certificates for privileged access.

The IP attempted to send emails from the IMAP server without authorization.

HEAD /: May be part of a larger Reconnaissance.

The IP was seen launching a DDoS attack on the Asterisk server, overwhelming it with traffic to disrupt its normal functioning.

Damaging activities showing connections to rootkit attacks were associated with this IP.

GET /manager/html: Signals an attempt to access the Tomcat Application Manager.

It was observed attempting to exploit known vulnerabilities in the IMAP protocol.

It attempted to perform a password spraying attack on the POP3 server.

SQL Injection in HTTP Requests: Logs record HTTP requests that contain SQL statements. Possible strings could include 'SELECT *' or 'DROP TABLE', indicative of a SQL injection attack.

The IP was involved in distributing malware, infecting systems or networks to steal data, cause damage, or gain unauthorized access.

Multiple Requests from Different IPs with Same User-Agent: This could be a signal of a coordinated attack originating from compromised machines.

The IP made multiple unsuccessful login attempts in a short period of time.

GET /wp-login.php: Indicating an attempt to access a WordPress login page.

This IP belongs to Phillips 66.

The malicious IP was seen trying to perform a Replay attack, capturing SIP authentication data and resending it to gain unauthorized access.

It attempted to perform a credential stuffing attack on the SASL server.

This IP belongs to Walmart.

Connection Timeout Abuse: Logs illustrating excessive requests that aim to use up server connections.