It attempted to perform Local File Inclusion (LFI) attacks on the Apache server.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.

The IP attempted to perform a replay attack on the SSH server.

The malicious IP was identified trying to leverage the Postfix service to send bulk spam emails.

This IP belongs to Amazon.

It repeatedly tried to inject malicious script code into the system via appending it to an email body.

This IP belongs to Shopify.

Purposefully tried to clog our mail server's resources by creating a mail loop configuration.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.

The IP attempted to use the FTP server to distribute zero-day exploit tools.

It attempted to upload malicious scripts to the Apache server.

GET /server-status: Often an attempt to check Apache server status.

The IP made multiple requests with the same Via header.

It was discovered illicitly scanning the server for potential vulnerabilities.

It showed an unusually high number of requests to the login page.

This IP belongs to Cigna.

This IP belongs to Vodafone.

Multiple requests with the same Referer header.

This IP belongs to Lockheed Martin.

This IP belongs to Procter & Gamble.

The IP attempted to perform XML External Entity (XXE) attacks on the Apache server.

It attempted to make unauthorized calls using the VOIP server.

This IP belongs to Phillips 66.

The IP attempted to perform a SIP Invite Flood on the SIP server.

It carried out IP spoofing to mimic a trusted IP with the intent of gaining unauthorized SSH access.