Frequent access requests from user agents that are known to be associated with malicious tools or bots.

Multiple requests with identical cookies.

A sudden surge in the number of requests per second, indicating an automated process.

The IP conducted exhaustive dictionary attacks, trying to guess password and username combinations.

It made multiple requests with the same X-Requested-With header.

The IP attempted to perform Security Misconfiguration attacks on the Apache server.

The malicious IP was suspected of cryptojacking, illicitly using others' computing resources to mine cryptocurrencies.

Unusual command line activities that are not typical for the server environment.

The IP attempted to perform a VOIP Hopper scan on the VOIP server.

It attempted to send emails with deceptive subject lines from the Mail server.

There were several attempts from this IP to manipulate our server DNS records.

The IP made multiple unsuccessful login attempts to the SASL server in a short period of time.

This IP belongs to Linode.

The IP attempted to perform a brute force attack on the SSH server.

It made numerous requests to the same endpoint in a short time.

Cross-Site Scripting (XSS): Logs show HTTP requests with string "

The IP address has been linked to the creation of artificial traffic to crash our website.

The IP address was identified sending packets with malicious payloads to our server, trying to exploit potential security holes.

The IP attempted to brute force the password to gain mail account access.

The IP attempted to perform Integer Overflow attacks on the Apache server.

The IP had been flagged for initiating SYN flood attacks on our servers.

The IP attempted to create new directories on the FTP server.

This IP belongs to Dell Technologies.

HTTP Request with Odd Timing: Very precisely timed HTTP requests could imply an automated tool or bot.

It attempted to perform a Land attack on the SSH server.