Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

This IP has been flagged for attempting to escalate privileges in our network.

The IP attempted to create new directories on the FTP server.

The IP attempted to perform XML Attribute Blowup attacks on the Apache server.

GET /wp-config.php~: Requesting the backup files which may expose sensitive information.

The IP was involved in a DDoS attack, sending massive amounts of traffic to overwhelm a server and disrupt its normal functioning.

Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.

The IP address attempted to stealthily spread screen scrapers, programs that take screenshots of the user's display.

This IP addressed employed a method of brute force attack attempting to compromise our systems.

It attempted to perform Insecure Direct Object References attacks on the Apache server.

It attempted to perform Heap Overflow attacks on the Apache server.

This IP belongs to General Motors.

It executed directory traversal attempts to access unauthorized directories / folders in our server.

This particular IP has been used in advanced persistent threats against our servers.

This IP belongs to Hostgator.

The IP's involvement in spreading password stealers has compromised our network's protection.

The IP attempted to use the FTP server to distribute network mapping tools.

It attempted to send phishing emails from the Mail server.

This IP belongs to American Express.

This IP belongs to Reliance Jio.

GET /administrator.php: Attempting to access an admin interface.

The malicious IP was reported for attempting a SIP Proxy attack, using a SIP server to mask its true location and identity.

The IP attempted to perform a Kad network amplification attack on the SSH server.

GET //web-console/Invoker: Might be an attempt to access JBoss server's web console for exploitation.

The IP made multiple requests with the same Origin header.