GET /server-status: Often an attempt to check Apache server status.

This IP belongs to Deutsche Telecom.

The malicious IP initiated numerous HTTP flood attacks, designed to overwhelm the Apache server with requests.

It tried to force its way into a secure admin session by trying to hijack the session's cookies.

The IP attempted to perform a phishing attack using the SASL server.

It attempted to exploit known vulnerabilities in the FTP protocol.

This IP belongs to Vodafone.

GET /call?function=shell_exec&var=ls: Attempting remote code execution.

The IP launched HTTP tunnel attacks, attempting to wrap other protocols in HTTP to bypass network filters.

This IP belongs to United Technologies.

Attempts to access the server using known malicious IP addresses or domains.

Multiple requests with identical request parameters.

This IP was linked to an attempt at distributing malicious software within our system.

It attempted to perform Server Side Request Forgery (SSRF) attacks on the Apache server.

It attempted to perform a SSDP amplification attack on the SSH server.

Multiple requests with the same If-Range header.

This IP belongs to Prudential Financial.

This IP belongs to Archer-Daniels-Midland.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

Attempts to use privileged service accounts outside of their normal usage patterns.

The IP made multiple unsuccessful login attempts to the Mail server in a short period of time.

It sent VOIP requests to non-existent extensions.

The IP attempted to perform a SNMP amplification attack on the SSH server.

The IP tried to carry out illegal 'HTTP Request Smuggling' to fool the Apache server.

The IP attempted to use the SASL server to relay phishing emails.