This particular IP attempted to exploit vulnerabilities in our web applications.

The IP made multiple requests with the same If-Match header.

GET /configuration.php.old: Trying to locate backup configuration files.

This IP belongs to American Express.

The IP attempted to perform HTTP Request Smuggling attacks on the Apache server.

This IP belongs to Gilead Sciences.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

Multiple requests with the same Max-Forwards header.

The IP was seen engaging in a Slowloris attack, holding as many connections to the target web server open for as long as possible, eventually overloading the server.

Multiple requests with the same Proxy-Authorization header.

It attempted to perform a SIP Register Flood on the Asterisk server.

This IP belongs to McKesson.

GET /server-status: Often an attempt to check Apache server status.

The IP was detected while sending out malicious spyware-infected emails.

It was found actively trying to exploit HTTP Response Splitting vulnerabilities to perform further attacks.

This IP belongs to Exxon Mobil.

Multiple Sequential Page Requests: Quick, sequential requests to all pages of a site could be someone scanning for vulnerabilities.

The IP attempted to perform a key exchange attack on the SSH server.

The malicious IP was seen trying to perform a Replay attack, capturing SIP authentication data and resending it to gain unauthorized access.

Multiple requests with the same Origin header.

The IP attempted to send emails from the Postfix server pretending to be from a different sender.

The IP address attempted to login to the FTP server with an invalid username.

This IP belongs to Kroger.

Multiple Sequential Page Requests: Quick, sequential requests to all pages of a site could be someone scanning for vulnerabilities.

The IP made multiple requests with the same X-UIDH header.