The IP attempted to perform Session Replay attacks on the Apache server.

Multiple requests with identical cookies.

It attempted to use the SASL server to distribute malware.

It was found that the IP has been exploiting zero-day vulnerabilities in our system.

This malicious IP was reported for attempting a Sniffing attack, capturing and analyzing FTP traffic to glean sensitive information.

Multiple requests with the same X-Csrf-Token header.

The IP was actively engaged in spear-phishing attacks, aimed at high-ranking officials within our network.

GET /setup.php: Effort to locate setup files for PHP applications.

It made multiple requests from user agents claiming to be bots.

The IP address attempted delivering malicious packets to disrupt the system's operation.

Multiple requests with the same Expect header.

The IP was linked to numerous attacks using web shells through web servers.

The IP address attempted to register as a SIP user with an invalid username.

It attempted to login to the SSH server with an invalid password.

This IP belongs to PLDT.

This IP belongs to Tech Data.

This IP belongs to Dell Technologies.

It appears that this IP was initiating DNSChanger malware attacks on our network.

Multiple account lockouts in a short period of time.

It made multiple requests with the same X-Forwarded-For header.

The IP attempted to send spam emails from the Mail server.

This IP belongs to Liberty Mutual Insurance Group.

Frequent access requests from user agents that are known to be associated with malicious tools or bots.

The IP performed forceful browsing, to access and exploit unprotected files and directories.

It attempted to carry out a dictionary attack on pop3 logins to gain unauthorized access.