HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

The IP tried to exploit buffer overflow vulnerabilities to run unauthorized code.

The IP attempted to perform Integer Overflow attacks on the Apache server.

This IP belongs to NetEase.

It attempted to perform a brute force attack on the POP3 server.

The IP sent numerous Asterisk OPTIONS requests in a short time.

The IP actively tried code replacement attacks, swapping legitimate system call addresses with malicious ones.

This IP belongs to American Express.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

Made various attempts at a forged return-path attack, attempting to spoof their source email address.

This IP belongs to Johnson & Johnson.

GET /admin: Looking for an unprotected admin page.

The IP made multiple requests with identical Accept-Encoding headers.

The IP address made multiple requests with identical request parameters.

This IP was detected distributing spyware-infected USB drives to our users.

This IP belongs to Comcast.

Unusually high CPU usage, which can indicate a brute force attack is in progress.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

This malicious IP attempted a brute force attack, trying to crack login credentials to gain unauthorized access to a system or account.

The malicious IP was involved in a SPIT (Spam over IP Telephony) attack, sending unsolicited messages over the VoIP server.

The IP address has been linked to the creation of artificial traffic to crash our website.

It was responsible for an unusual increase in server CPU usage.

The IP attempted to use the Mail server to relay spam to other servers.

Multiple requests from different IP addresses in a short span of time, suggesting a distributed brute force attack.

It launched invasive malware to corrupt crucial segments of our server functionality.