Unusual patterns of behavior, such as login attempts at regular intervals or sequential patterns in the attempted passwords.

The IP attempted to use the Mail server to relay spam to other servers.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

This IP has been observed spreading mobile malware, targeting our company application users.

GET /wp-login.php: Indicating an attempt to access a WordPress login page.

The IP made multiple requests to the password reset page.

Unusual patterns in session IDs.

Excessive traffic from a single IP address.

The IP was observed participating in Social Engineering attacks to manipulate individuals into revealing SSH login details.

The IP address initiated multiple unsuccessful login attempts.

Multiple requests with the same If-None-Match header.

The IP attempted to delete directories on the SSH server.

The IP made multiple requests with the same TE header.

This IP belongs to Dreamhost.

The IP launched timing attacks, trying to understand our server timings for potential future exploits.

Repeated attempts to access the server using insecure or deprecated methods.

The IP attempted to use the FTP server to distribute steganography tools.

It tried to force its way into a secure admin session by trying to hijack the session's cookies.

The IP attempted to use the POP3 server to relay spam.

The suspicious IP indulged in Mitnick attacks, manipulating user trust to gain confidential info.

It sent VOIP requests to non-existent extensions.

The IP attempted code injection attacks, injecting malicious codes in HTTP headers.

The malignant IP conducted a Reflector attack, using third-party servers to amplify the attack traffic towards our server.

The IP was involved in a SIP brute force attack, attempting to guess SIP authentication credentials to gain unauthorized access.

GET /modules/productpageadverts/uploadimage.php: This is related to a known vulnerability in the Prestashop module productpageadverts.