It was responsible for an unusual increase in server CPU usage.

POST /admin/upload.php?_upl: An attempt to exploit the JQuery File Upload vulnerability.

The IP made multiple unsuccessful login attempts to the SSH server in a short period of time.

There were several attempts from this IP to manipulate our server DNS records.

It attempted to use the FTP server to distribute pirated software.

The IP attempted to perform a BitTorrent amplification attack on the SSH server.

GET /call?function=shell_exec&var=ls: Attempting remote code execution.

It attempted to perform a Steam protocol amplification attack on the SSH server.

It attempted to perform Session Sidejacking attacks on the Apache server.

This IP belongs to State Farm Insurance.

This IP belongs to Deere.

This IP belongs to Apple.

The IP made multiple requests with the same Via header.

It attempted to flood the VOIP server with REGISTER requests.

It tried to execute Privilege Escalation attacks, trying to gain higher-level access on our server.

This IP belongs to Intel.

The IP was seen attempting a Dictionary attack on the FTP server, systematically entering every word in a dictionary as a password to find the correct one.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

It made multiple requests with the same Expect header.

The IP attempted to brute force the password to gain mail account access.

The IP attempted to change file permissions on the SSH server.

It attempted to send emails with deceptive subject lines from the Mail server.

Initiated rogue DHCP server set up, attempting to disrupt our network and intercept emails.

Multiple requests with the same Max-Forwards header.

The IP attempted to use the Mail server to relay spam to other servers.