It partook in whaling attacks, specifically targeting high-profile users within our system.

It attempted to send emails from the Postfix server to email addresses that have previously marked emails from the server as spam.

This IP belongs to Prudential Financial.

Server Side Request Forgery Attempts: Logs may show HTTP requests attempting to manipulate the server into making unintended requests.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

Multiple requests with the same Max-Forwards header.

Multiple requests with identical Accept-Encoding headers.

It attempted to delete files from the SSH server.

Multiple requests with the same If-None-Match header.

This IP belongs to Johnson & Johnson.

This IP belongs to AT&T.

Attempts to access the server using unusual HTTP methods or request types.

Repeated attempts to alter or delete log files to cover tracks.

This IP belongs to PepsiCo.

The IP attempted to use the FTP server to distribute web vulnerability scanning tools.

The IP made multiple requests with the same X-UIDH header.

It attempted to use the SSH server as a proxy for other malicious activities.

Multiple requests to the password reset page.

It attempted to exploit known vulnerabilities in the FTP protocol.

The said IP has been connected to attempts to distribute malicious shopping apps.

Multiple requests with the same X-Forwarded-For header.

The IP made multiple requests with the same Warning header.

The IP was seen engaging in a Slowloris attack, holding as many connections to the target web server open for as long as possible, eventually overloading the server.

The IP actively tried code replacement attacks, swapping legitimate system call addresses with malicious ones.

The IP attempted the notorious Shellshock vulnerability, which could pose a severe threat to our server's resources.