GET /etc/passwd: An attempt to retrieve Linux server user account details.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

The IP tried creating false server responses hoping to disrupt the SASL service.

The IP attempted to perform a Nestea attack on the SSH server.

The IP address attempted to exploit known vulnerabilities in server software.

This IP belongs to Marathon Petroleum.

The IP was involved in a FTP Spam attack, using the FTP server to distribute unsolicited emails or messages.

This IP belongs to American Express.

Rapid sequence of login attempts.

The IP attempted to perform a downgrade attack on the SSH server.

The IP attempted to use the FTP server to distribute web vulnerability scanning tools.

GET /.env: Attempting to access a file that may contain sensitive environment variable data.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

It made multiple requests with the same If-None-Match header.

It attempted to exploit known vulnerabilities in the Mail protocol.

This IP belongs to American Express.

It attempted to flood the VOIP server with REGISTER requests.

The IP attempted to gain unauthorized access to the Apache server.

The IP attempted to use the FTP server to distribute anonymizing tools.

This IP directed malicious network traffic to our servers with the intent to crash them.

Multiple failed login attempts using different usernames.

It attempted multiple LDAP injection attacks to gain unauthorized access.

Multiple requests with identical cookies.

It attempted to delete files from the SSH server.

It attempted to perform a denial of service attack on the SSH server.