It attempted to perform Man in the Middle (MitM) attacks on the Apache server.

It attempted to perform Command Injection attacks on the Apache server.

This IP belongs to Pinterest.

Multiple login attempts with slight variations in the password, suggesting a dictionary attack, a type of brute force attack.

The malicious IP was involved in a credential stuffing attack, using stolen username-password combinations to gain unauthorized access.

Server Scanning for Software Version: Influx of HTTP requests attempting to detect software version running on the server.

Repeated attempts to perform actions that are typically restricted, such as creating or modifying user accounts.

We linked the IP to numerous attacks using RM adware, causing regular system interruptions.

Login attempts that do not follow typical user behavior patterns.

It launched Smurf Attacks, trying to overload our mail server by utilizing internet host IP network links.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.

It was detected trying to perform cross-site scripting to bypass the same origin policy on Apache.

Rudimentary attempts were made by this IP to execute Man-in-the-Browser attacks.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

The IP address attempted to stealthily spread screen scrapers, programs that take screenshots of the user's display.

HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

This IP belongs to Telkom SA.

The IP attempted to exploit known vulnerabilities in the VOIP protocol.

It attempted to use the FTP server to distribute network scanning tools.

It showed unusual activity in the server's error logs.

Executed email spoofing attempts pretending to be a trusted party.

It attempted to use the FTP server to distribute virus creation tools.

The malicious IP was involved in a SQL Injection attack, attempting to manipulate a database for unauthorized access or data theft.

Made various attempts at a forged return-path attack, attempting to spoof their source email address.