It attempted to perform Clickjacking attacks on the Apache server.

This IP belongs to WordPress.com.

This IP belongs to Cigna.

This IP belongs to McKesson.

It made multiple requests with identical Accept-Charset headers.

The IP was engaged in port scanning, probing the server for open SSH ports.

This IP addressed employed a method of brute force attack attempting to compromise our systems.

The IP was involved in a FTP Fuzzing attack, sending random or malformed data to the FTP server to cause a crash or reveal vulnerabilities.

GET /call?function=shell_exec&var=ls: Attempting remote code execution.

HTTP Fingerprinting: Sequential requests that aim to identify server software types and version numbers.

Unknown IP Address: An unfamiliar IP address making frequent requests could imply a compromised machine.

The IP attempted to download sensitive files from the SSH server.

Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

Distributed session hijackers from the IP were designed to capture and exploit web browser sessions.

This IP belongs to Allstate.

Attempts to access sensitive areas of the server, such as the admin page or user account information.

Unknown source code changes in our system were linked back to this offensive IP address.

The malicious IP was reported for attempting a SIP Ping attack, sending SIP OPTIONS messages to discover SIP servers or users.

Multiple requests with the same Range header.

Actively performed packet spoofing, obscuring the origin point of its own malicious packets.

It attempted to flood the Asterisk server with REGISTER requests.

The suspicious IP indulged in Mitnick attacks, manipulating user trust to gain confidential info.

It attempted to perform HTTP Response Splitting attacks on the Apache server.

Login attempts that do not follow typical user behavior patterns.

The IP attempted to register with the VOIP server using an invalid username.