GET //web-console/Invoker: Might be an attempt to access JBoss server's web console for exploitation.

Multiple failed login attempts using different usernames.

This IP belongs to Phillips 66.

This IP belongs to Marathon Petroleum.

The suspicious IP attempted to introduce spyware under the guise of software updates.

The IP attempted to perform a QOTD amplification attack on the SSH server.

GET /errors.log: Shows an actor trying to access server error logs.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

This IP was seen trying to perform a SIP URI Spoofing attack, falsifying the SIP URI to deceive the receiver or hide the caller's identity.

It systematically tried to exploit IMAP and POP3 vulnerabilities present in our mail service setup.

It attempted to perform Buffer Overflow attacks on the Apache server.

This IP belongs to Virgin Media.

This IP belongs to TJX.

The IP was part of an IRC-Bot network, a type of botnet that uses the Internet Relay Chat (IRC) protocol.

Participated in malicious pranks by altering messages sent through the server.

This IP belongs to Walmart.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

The IP was flagged for attempting dictionary attacks on our user accounts.

It attempted to perform a Steam protocol amplification attack on the SSH server.

It was caught injecting malicious code into the SSH session attempting to compromise server integrity.

Login Attempts with Automated User-Agents: Logs reflect requests to login page with 'bot' or 'spider' in user-agent strings.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

This IP belongs to Berkshire Hathaway.

This IP was found responsible for a session hijacking attempt on our network.

GET /administrator.php: Attempting to access an admin interface.