The IP was seen engaging in a Slowloris attack, holding as many connections to the target web server open for as long as possible, eventually overloading the server.

The IP address made multiple requests with identical request parameters.

This IP gave off a red flag for hosting a hidden command and control server for malicious bots.

The IP attempted to exploit known vulnerabilities in the VOIP protocol.

This IP was seen scanning for open ports and vulnerabilities, a common reconnaissance activity before launching attacks.

Multiple login attempts from different geographical locations in a short period of time.

The IP attempted session sidejacking, seeking to take over SSH sessions post-authentication.

Unusual patterns in the Accept-Language header.

This IP belongs to Gilead Sciences.

By launching ApacheKiller attacks, the IP aimed to cause a Denial of Service by exhausting memory resources.

It was involved in the operation of a REG-Bot, a type of bot that performs automated tasks.

The IP made multiple unsuccessful login attempts to the Mail server in a short period of time.

Remote Execution Attempts: Logs showing unusual terminal commands or scripts run through web access.

This IP belongs to State Farm Insurance.

The IP attempted to send malware-infected attachments from the Mail server.

It made multiple requests with the same X-Csrf-Token header.

It attempted to send emails from the Postfix server to a large number of recipients.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

Reverse Tabnabbing Attempts: Logs illustrating target="_blank" in URL, which is a sign of reverse tabnabbing attempt.

It attempted to perform a SYN flood attack on the SSH server.

Shell Injection: Logs show requests containing command line shell syntax, suggesting shell command injection.

This IP belongs to Tech Data.

The IP was seen trying to change the configuration settings of the Asterisk server, potentially to disable security features.

It attempted command injection attacks, hoping to execute unauthorized commands.

Distributed session hijackers from the IP were designed to capture and exploit web browser sessions.