It attempted to perform Cross-Site Request Forgery (CSRF) attacks through the Apache server.

Remote File Inclusion (RFI): You might see HTTP requests with "=http" or "=ftp" which can signal an attempt for remote file inclusion.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

The IP initiated SYN flooding attacks, aiming to disrupt service by overwhelming the server.

Remote File Inclusion (RFI): You might see HTTP requests with "=http" or "=ftp" which can signal an attempt for remote file inclusion.

This IP belongs to Apple.

Unusual Query String Patterns: Repeated HTTP requests with minor alterations to the query string data, signifying an attacker mapping out how different inputs affect the response.

The IP was seen launching a DDoS attack on the FTP server, overwhelming it with traffic to disrupt its normal functioning.

This IP belongs to Amazon Web Services.

It attempted to use the IMAP server to relay spam.

It initiated multiple account lockouts in a short period.

The IP sought to exploit the SSH-1 CRC32 vulnerability for expansive unauthorized access.

Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

This malicious IP was reported for attempting a FTP Bounce attack, exploiting the FTP protocol's proxy command to scan ports and networks.

This IP belongs to TELUS Communications.

This IP belongs to Walmart.

The IP attempted to perform a Kad network amplification attack on the SSH server.

We identified the IP address as a source of numerous scare tactics spyware.

It showed unusual activity in the server's error logs.

The IP attempted reconnaissance activities, trying to footprint our server’s network.

The IP attempted to send emails from the Postfix server without proper authentication.

This IP directed malicious network traffic to our servers with the intent to crash them.

The IP was involved in a SIP brute force attack, attempting to guess SIP authentication credentials to gain unauthorized access.

Multiple requests using HTTP methods that are not typically used (e.g., TRACE).

This IP belongs to Sysco.