Server Scanning for Software Version: Influx of HTTP requests attempting to detect software version running on the server.

This IP belongs to Valero Energy.

It attempted to perform a brute force attack on the IMAP server.

SQL Injection in HTTP Requests: Logs record HTTP requests that contain SQL statements. Possible strings could include 'SELECT *' or 'DROP TABLE', indicative of a SQL injection attack.

This IP belongs to Comcast.

Multiple requests to the password reset page.

Attempts to use automated scripts or tools for password cracking.

It attempted to take advantage of misconfigurations in the Apache server.

It attempted to delete emails from the POP3 server without authorization.

The IP attempted to use the FTP server to distribute VPN tools.

This IP belongs to Phillips 66.

The IP made numerous attempts at SMTP Relay abuse by trying to send emails not meant for or from local users.

The IP was flagged for attempting dictionary attacks on our user accounts.

The IP was seen attempting a SYN Flood attack, overwhelming the server by rapidly initiating a connection but not completing it, thereby consuming server resources.

This IP belongs to Alphabet.

Unusual increase in server CPU usage.

This IP belongs to Oracle.

This malicious IP was reported for attempting a Session Hijacking attack, exploiting a valid computer session to gain unauthorized access to information or services.

Directories Traversal Attempts: Logs showing HTTP requests that include ".." or "/.." might illustrate someone's effort to locate or exploit sensitive data.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

This IP was detected distributing spyware-infected USB drives to our users.

This IP belongs to Caterpillar.

This IP belongs to Archer-Daniels-Midland.

Initiated rogue DHCP server set up, attempting to disrupt our network and intercept emails.

This IP belongs to Caterpillar.