The IP attempted to perform Man in the Browser (MitB) attacks on the Apache server.

This IP belongs to Linode.

GET /vuln.html: Looking for any page vulnerabilities.

This IP belongs to Shopify.

This IP belongs to Mondelez International.

Cross-Site Scripting (XSS): Logs show HTTP requests with string "

The malicious IP was found to be running an Internet Relay Chat (IRC) bot, potentially spreading malware or launching Distributed Denial-of-Service (DDoS) attacks.

This IP belongs to Fannie Mae.

The detected IP address was responsible for the distribution of botnets aimed at automating data theft.

The IP address initiated attacks using DDoS, impacting our server response times.

The malicious IP attempted to brute-force the .htaccess file to gain unauthorized administrative access.

This IP belongs to Telus Communications.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

It launched Spoofing attacks, trying to hide its identity by disguising itself as a trusted user or server.

This IP belongs to AT&T.

The IP attempted to perform a SIP Invite Flood on the SIP server.

udden increase in account lockouts due to multiple failed login attempts.

Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

It attempted to perform a SYN flood attack on the SSH server.

The IP attempted a pass-the-hash attack, trying to authenticate without knowing the plaintext password.

Smuggling Attack: Logs showing a single IP initiating multiple sessions, implying a Smuggling Attack.

Repeated attempts to access rarely used or hidden services on the server.

It made multiple attempts to initiate malicious File Transfer Protocol (FTP) sessions with the Postfix service.

This IP belongs to Shopify.