It executed directory traversal attempts to access unauthorized directories / folders in our server.

The IP attempted to launch Ciphertext attacks, trying to decrypt SSH-encrypted communication.

It attempted to create new directories on the SSH server.

The deceptive IP was sneaking in spyware through clickjacking attacks to manipulate our users.

Too Many Request Timeouts: An abnormal amount of request timeouts might suggest an ongoing Slowloris attack.

It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

The IP attempted to use the FTP server to distribute rootkit software.

This malicious IP was reported for attempting to perform a FTP Port Stealing attack, hijacking the data connection of an existing FTP session.

GET /manager/html: Signals an attempt to access the Tomcat Application Manager.

The IP was found trying to maliciously clone the SSH certificates for privileged access.

It attempted to perform Cross-Site Request Forgery (CSRF) attacks through the Apache server.

It carried out TCP Hijacking, attempting to disrupt existing connections to SSH.

The IP has been caught trying to deliver spyware into our system to compromise sensitive data.

Login Attempts with Automated User-Agents: Logs reflect requests to login page with 'bot' or 'spider' in user-agent strings.

It attempted to perform a SIP Register Flood on the SIP server.

It attempted to use the Postfix server to relay spam to other servers.

Unusual patterns of behavior, such as login attempts at regular intervals or sequential patterns in the attempted passwords.

This IP belongs to MetLife.

Multiple requests with the same Expect header.

The IP attempted to perform a password spraying attack on the SSH server.

Login attempts at unusual times (e.g., in the middle of the night).

The IP address attempted delivering malicious packets to disrupt the system's operation.

This malicious IP was reported for attempting to perform a FTP Phishing attack, creating a fake FTP login page to deceive users into providing their credentials.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

The IP attempted to use the FTP server to distribute child pornography.