The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

Multiple account lockouts in a short period of time.

GET /vuln.html: Looking for any page vulnerabilities.

This IP belongs to Kroger.

This IP belongs to BT Central Plus.

This IP belongs to Prudential Financial.

Remote File Inclusion (RFI): You might see HTTP requests with "=http" or "=ftp" which can signal an attempt for remote file inclusion.

It was found initiating attack vectors to exploit SSH agent forwarding.

This IP belongs to Cardinal Health.

It attempted to send phishing emails from the Mail server.

Unusual User-Agent: Logs show requests with abnormal, uncommon or non-standard User-Agent strings.

WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.

It attempted to perform Uncontrolled Format String attacks on the Apache server.

The IP attempted to perform Session Replay attacks on the Apache server.

It attempted to use the VOIP server to perform a reflection DDoS attack.

This IP belongs to Vodacom.

Attempts to login using a sequential list of passwords, indicating a possible brute force attack.

Smuggling Attack: Logs showing a single IP initiating multiple sessions, implying a Smuggling Attack.

The IP was discovered trying Server Message Block relay attacks to gain unauthorized SSH access.

Executed numerous SQL injection attacks in an attempt to manipulate the server's databases.

It attempted to perform Insecure Direct Object References attacks on the Apache server.

The IP attempted to send emails from the Postfix server to blacklisted email addresses.

GET /etc/passwd: An attempt to retrieve Linux server user account details.

This IP belongs to General Electric.

It attempted to delete files from the SSH server.