It attempted to use the FTP server to distribute encryption tools.

Multiple requests from different IP addresses in a short span of time, suggesting a distributed brute force attack.

Multiple requests from user agents claiming to be bots (e.g., Googlebot) that do not match known bot IP ranges.

This IP belongs to SingTel.

It repeatedly tried to inject malicious script code into the system via appending it to an email body.

Login Attempts with Automated User-Agents: Logs reflect requests to login page with 'bot' or 'spider' in user-agent strings.

This IP belongs to Hostgator.

Repeated requests for the same file or page, indicating an attempt to crack a password or exploit a vulnerability.

Rapid sequence of login attempts.

Multiple requests with the same TE (Transfer Encoding) header.

This IP belongs to Orange France Telecom.

GET /setup.php: Effort to locate setup files for PHP applications.

The IP attempted to perform a SIP Invite Flood on the Asterisk server.

GET /trace.axd: An attempt to find a debug handler in ASP.NET.

The IP attempted reconnaissance activities, trying to footprint our server’s network.

The IP attempted to send spam emails from the Mail server.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

This IP was reported for attempting a Teardrop attack, sending mangled IP fragments with overlapping and oversized payloads to crash the target network device.

The IP address attempted to login to the Mail server with an invalid username.

Ping of Death: Logs showing oversized ICMP requests could suggest Ping of Death attacks.

Suspicious Http Referrer Field: HTTP requests with external referrer headers that usually originate from internal source.

This malicious IP was reported for attempting a Sniffing attack, capturing and analyzing FTP traffic to glean sensitive information.

This IP belongs to JPMorgan Chase.

The IP launched timing attacks, trying to understand our server timings for potential future exploits.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.