It started header injection or email injection attempts, by adding extra data into the headers and confusing the server processes.

It made multiple requests with the same Range header.

It showed unusual patterns in the sequence of requests.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

The IP address attempted to exploit known vulnerabilities in the Apache server software.

This IP belongs to Exxon Mobil.

This IP belongs to Chevron.

The IP was part of an IRC-Bot network, a type of botnet that uses the Internet Relay Chat (IRC) protocol.

It attempted to use the FTP server to distribute encryption tools.

The IP used a 'Poodle' attack in attempts to downgrade the server's SSL to a more vulnerable state.

It attempted to move emails to different folders on the IMAP server without authorization.

Multiple requests with the same X-Att-Deviceid header.

This IP belongs to MTN.

It utilized Web scrapers, automatically harvesting content from our server.

Multiple login attempts using common or easily guessable passwords (like 'password123', 'admin', etc.).

This IP belongs to FedEx.

This IP belongs to Marathon Petroleum.

The IP attempted to use the FTP server to distribute secure deletion tools.

HTTP Fingerprinting: Sequential requests that aim to identify server software types and version numbers.

Multiple requests with the same Via header.

It appears this IP was linked to a number of drive-by-download attacks, silently downloading spyware.

System logs have traced multiple cases of our servers being bombed with trojans to this IP.

Unidentified password attempts and login activity were noticed from the specific IP address.

This IP belongs to United Parcel Service.

The IP attempted to perform Session Replay attacks on the Apache server.