GET /setup.php: Effort to locate setup files for PHP applications.

GET /wp-config.php~: Requesting the backup files which may expose sensitive information.

GET /wp-config.php~: Requesting the backup files which may expose sensitive information.

The IP used a 'Poodle' attack in attempts to downgrade the server's SSL to a more vulnerable state.

The IP attempted to perform Session Replay attacks on the Apache server.

It attempted to perform a dictionary attack on the SASL server.

Too Many HTTP 404 Errors: A high number of 404 Page Not Found errors may indicate an attacker trying to find valid directories or pages.

The IP made multiple requests with the same Via header.

A series of unusual file transfers originated from this IP.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.

This IP belongs to DuPont de Nemours.

This IP belongs to Airtel.

We linked several cryptojacking attempts, aimed at harnessing our system resources, to this IP.

It attempted to use the FTP server to store illegal content.

The IP was engaged in port scanning, probing the server for open SSH ports.

This IP belongs to IBM.

The IP actively tried code replacement attacks, swapping legitimate system call addresses with malicious ones.

The IP was seen launching a DDoS attack on the FTP server, overwhelming it with traffic to disrupt its normal functioning.

Multiple requests with the same X-Forwarded-For header.

The IP was linked to numerous attacks using web shells through web servers.

It attempted to send emails from the Postfix server to email addresses that have previously marked emails from the server as spam.

This IP belongs to State Farm Insurance.

Suspicious URL Encoding: Seeing HTTP requests with a lot of %, suggesting URL encoding to evade detection.

Cross-Site Scripting (XSS): Logs show HTTP requests with string "

It attempted to carry out a 'Ping of Death' operation, hoping to crash the server.