It participated in Unvalidated Redirects and Forwards attacks, leading users to malicious websites via altered SSH links.

HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

This IP belongs to Orange France Telecom.

Repeated attempts to exploit known vulnerabilities in the server operating system or applications.

It attempted to use the FTP server to distribute botnet command and control software.

Bursts of login attempts followed by periods of inactivity, suggesting an attacker is trying to avoid detection.

The IP attempted to execute unauthorized commands on the SSH server.

The IP attempted to send emails from the Postfix server that violate the server's terms of service.

This malicious IP was reported for trying to perform a FTP Zombie Scan, using the FTP server to mask its true location and identity.

POST /db/images/: Attempt to post or insert a malicious file in the images directory of a database.

The IP attempted to inject malicious scripts into the server hoping it would get executed.

The IP was linked to numerous attacks using web shells through web servers.

This malicious IP was reported for attempting to execute a Cross-Site Request Forgery (CSRF) attack, tricking a victim into executing unwanted actions on the FTP server.

The IP was caught attempting to exploit known vulnerabilities within Postfix to gain unauthorized access.

The IP has initiated several exploits, specifically for software vulnerabilities.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

This IP belongs to Mondelez International.

The IP sent malicious links via IM softwares, aiming to spread instant messaging worms.

The IP attempted to perform Session Hijacking attacks on the Apache server.

This IP belongs to Cisco Systems.

Uncommon Referer Header: HTTP logs record requests from an uncommon or suspicious 'Referer' header.

We noticed the IP attempting to compromise our IoT devices by spreading IoT malware.

The IP attempted to perform a BitTorrent amplification attack on the SSH server.

The IP was involved in a SIP Flooding attack, sending a large number of SIP messages in a short period to overwhelm the server.

Unknown IP Address: An unfamiliar IP address making frequent requests could imply a compromised machine.