It made multiple requests with the same Expect header.

Multiple requests with identical Accept-Charset headers.

It attempted to exploit known vulnerabilities in the SSH protocol.

The IP made multiple requests with the same Proxy-Connection header.

Multiple requests with identical POST parameters.

This IP belongs to TIAA.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

This IP belongs to Canadian Department of Defense.

This IP belongs to WordPress.com.

It actively sought to exploit unpatched software within our server applications.

This IP address from an unusual location has successfully installed malware on our servers.

The IP sought to exploit the SSH-1 CRC32 vulnerability for expansive unauthorized access.

The IP address was found roaming through the network, scanning for weak spots.

GET /backup.sql: Attempting to access a backup of your database.

It attempted to send emails from the Postfix server that violate the server's email content policy.

Smuggling Attack: Logs showing a single IP initiating multiple sessions, implying a Smuggling Attack.

The IP attempted to perform XML External Entity (XXE) attacks on the Apache server.

Multiple attempts to access the server using credentials that were previously compromised in a data breach.

The IP was seen trying to upload files to the FTP server, possibly with the intent of distributing malware.

This IP belongs to Allstate.

It attempted to create new directories on the SSH server.

It attempted to use the SASL server to distribute malware.

The IP was involved in a FTP Flood attack, sending a large number of FTP connection requests to overwhelm the server.

Multiple login attempts with slight variations in the password, suggesting a dictionary attack, a type of brute force attack.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.