The IP has been caught trying to deliver spyware into our system to compromise sensitive data.

The malicious IP was reported for attempting unauthorized logins to the FTP server, potentially to gain access to sensitive files.

Unusually high number of requests to a specific service or application within the server.

It attempted to use the SSH server as a proxy for other malicious activities.

The malignant IP conducted a Reflector attack, using third-party servers to amplify the attack traffic towards our server.

The IP attempted to execute unauthorized commands on the SSH server.

The IP was found trying to maliciously clone the SSH certificates for privileged access.

This malicious IP was reported for attempting to perform a Replay attack, capturing FTP authentication data and resending it to gain unauthorized access.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

It attempted to perform a Chargen amplification attack on the SSH server.

Forceful Browsing: Attempts to access pages or resources without proper navigation.

GET /configuration.php.old: Trying to locate backup configuration files.

Login Attempts with Automated User-Agents: Logs reflect requests to login page with 'bot' or 'spider' in user-agent strings.

This IP belongs to DuPont de Nemours.

Multiple requests with the same X-Att-Deviceid header.

It attempted to perform Command Injection attacks on the Apache server.

The IP engaged in DNS Spoofing, rerouting our server's lookups to a malicious destination.

This IP belongs to Bank of America.

The IP attempted to send emails from the Postfix server that violate the server's terms of service.

Server Side Request Forgery Attempts: Logs may show HTTP requests attempting to manipulate the server into making unintended requests.

It attempted to list the contents of directories that it should not have access to.

This IP was reported for attempting to register a large number of SIP extensions in a short time, a sign of a potential brute force attack.

Multiple Sequential Page Requests: Quick, sequential requests to all pages of a site could be someone scanning for vulnerabilities.

It attempted to send emails with deceptive subject lines from the Postfix server.

Repeated attempts to exploit known vulnerabilities in server software.