The IP made multiple requests with the same Via header.

The IP attempted to perform a VOIP Hopper scan on the VOIP server.

The IP attempted to use the FTP server to distribute child pornography.

It attempted to use a TearDrop attack to corrupt data packets being sent to our server.

Attempted to employ SSL-bumping for a man-in-the-middle attack to decrypt our secured data.

The IP attempted to perform XML Attribute Blowup attacks on the Apache server.

SQL Injection in HTTP Requests: Logs record HTTP requests that contain SQL statements. Possible strings could include 'SELECT *' or 'DROP TABLE', indicative of a SQL injection attack.

GET /.env: Attempting to access a file that may contain sensitive environment variable data.

This IP belongs to Abbott Laboratories.

It attempted to login to the Postfix server with an invalid password.

Our system blocked an attempted Code Injection attack from this IP.

It was caught injecting malicious code into the SSH session attempting to compromise server integrity.

This IP belongs to CVS Health.

Usage of Obscure HTTP Verbs: Seeing non-standard HTTP methods like DEBUG, PUT, or CONNECT could imply a web-based attack.

The said IP was the source of several rootkit deployment attempts.

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

This IP belongs to Twenty-First Century Fox.

The IP was involved in a FTP Flood attack, sending a large number of FTP connection requests to overwhelm the server.

The IP attempted to perform Session Fixation attacks on the Apache server.

The malicious IP was reported for sending a high volume of SIP INVITE requests, a potential sign of a call flooding attack.

The malicious IP was reported for attempting a SIP Ping attack, sending SIP OPTIONS messages to discover SIP servers or users.

The IP attempted to perform Directory Traversal attacks on the Apache server.

This IP has been observed spreading mobile malware, targeting our company application users.

The IP attempted to perform a Fraggle attack on the SSH server.

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.