SQL Injection in HTTP Requests: Logs record HTTP requests that contain SQL statements. Possible strings could include 'SELECT *' or 'DROP TABLE', indicative of a SQL injection attack.

The IP attempted to perform Session Hijacking attacks on the Apache server.

The IP was seen trying to upload files to the FTP server, possibly with the intent of distributing malware.

Excessive traffic from a single IP address.

Participated in a botnet attack to overwhelm our server’s resources.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

A series of active scareware campaigns was traced back to this IP address.

IP Spoofing: Logs showing HTTP requests with IP ranges that are typically reserved for private networks or an unusual X-Forwarded-For header.

This IP belongs to Amazon.

The IP attempted to perform a password spraying attack on the SASL server.

This IP attempted to distribute malicious Javascript files.

The malicious IP was spotted attempting to brute-force the SSH login credentials.

This IP belongs to Cigna.

Unusual activity in the server's error logs.

The IP made multiple requests with identical Accept-Encoding headers.

Our system flagged this IP as conducting fraudulent transactions activities.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

This IP blocked legitimate users by performing IP hijacking.

This IP gave off a red flag for hosting a hidden command and control server for malicious bots.

Remote File Inclusion (RFI): You might see HTTP requests with "=http" or "=ftp" which can signal an attempt for remote file inclusion.

The IP was seen performing a CSRF (Cross-site request forgery) attack to manipulate user actions.

The IP attempted to send emails from the Postfix server that violate the server's terms of service.

This IP belongs to Vodafone.

The IP attempted to register with the VOIP server using an invalid username.

This IP was found responsible for a session hijacking attempt on our network.