Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

Multiple Sequential Page Requests: Quick, sequential requests to all pages of a site could be someone scanning for vulnerabilities.

Repeated attempts to use the same password across multiple accounts.

The IP attempted to perform Directory Traversal attacks on the Apache server.

This IP belongs to Exxon Mobil.

The IP made multiple requests with the same If-Range header.

It attempted to use the POP3 server to relay phishing emails.

Unauthorized HTTP Method Usage: Logs showing unauthorized methods being attempted on the server, like TRACE or PATCH.

It attempted to perform HTTP Parameter Pollution attacks on the Apache server.

The IP was reported for hosting a phishing website, deceiving users into providing their sensitive personal or financial information.

The malicious IP was reported for attempting to manipulate file permissions on the FTP server, potentially to gain unauthorized access or expose sensitive data.

GET /backup.sql: Attempting to access a backup of your database.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

The IP attempted to mark emails as read on the IMAP server without authorization.

It attempted to use the Asterisk server as a relay for calls to premium-rate numbers.

GET /.env: Attempting to access a file that may contain sensitive environment variable data.

The IP sent numerous Asterisk OPTIONS requests in a short time.

It made multiple requests with the same If-None-Match header.

Frequent access requests from user agents that are known to be associated with malicious tools or bots.

It initiated various replay attacks, attempting to disrupt the system by re-transmitting legitimate data verbatim.

Our technical team unearthed the IP's involvement in distributing malicious mobile spyware.

Several cross-site scripting attacks were traced back to this IP.

Our system logs indicate this IP has been pushing illegitimate browser plugins into our network.

This IP has been marked as the origin of numerous SQL injection attacks.

Server Side Template Injection: Suspicious input patterns aimed at coercing server-side parsers to execute injected code.