It initiated several reverse IP lookup requests, probing for server vulnerabilities.

This IP belongs to General Motors.

It exploited insecure server configurations and attempted to establish reverse SSH tunneling.

Multiple failed login attempts from the same IP address in a short span of time.

It repeatedly attempted to run server-side injection attacks, trying to execute malicious code on our server.

Unusual patterns in the sequence of requests.

This IP belongs to PepsiCo.

DNS changer spyware originating from the flagged IP was designed to redirect our network traffic.

The IP tried creating false server responses hoping to disrupt the SASL service.

The IP initiated SYN flooding attacks, aiming to disrupt service by overwhelming the server.

GET /administrator.php: Attempting to access an admin interface.

Multiple failed login attempts using different usernames.

The IP sent malformed SIP requests, potentially indicating an attempt to crash the server.

It attempted to perform Race Condition attacks on the Apache server.

This IP belongs to Comcast.

Unauthorized HTTP Method Usage: Logs showing unauthorized methods being attempted on the server, like TRACE or PATCH.

This IP belongs to Target.

POST /WebResource.axd: Attempting to exploit a known .NET vulnerability.

This IP address from an unusual location has successfully installed malware on our servers.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

Unexpected changes in the server configuration or installed software.

The IP made multiple unsuccessful login attempts to the POP3 server in a short period of time.

Content Sniffing: Logs reflect HTTP requests that include the Accept header with " / ", suggesting an attacker is trying to detect what types of content the server will send.

This IP belongs to McKesson.

The IP attempted to download emails from the IMAP server without authorization.