Unusually high CPU usage, which can indicate a brute force attack is in progress.

Server Side Request Forgery Attempts: Logs may show HTTP requests attempting to manipulate the server into making unintended requests.

It attempted to perform Command Injection attacks on the Apache server.

The IP was part of an IRC-Bot network, a type of botnet that uses the Internet Relay Chat (IRC) protocol.

It attempted to carry out a 'Ping of Death' operation, hoping to crash the server.

This IP belongs to Deutsche Telekom AG.

It attempted to use the FTP server to distribute traffic monitoring tools.

This IP belongs to AT&T.

This IP belongs to Humana.

It sought to exploit cross-site scripting (XSS) vulnerabilities within our mail service web interface.

This IP belongs to Microsoft.

The IP attempted to perform Remote File Inclusion (RFI) attacks on the Apache server.

Numerous requests for non-existent pages, suggesting the attacker is probing for vulnerabilities.

This IP belongs to CVS Health.

It attempted to perform a man-in-the-middle attack on the IMAP server.

Uncommon Referer Header: HTTP logs record requests from an uncommon or suspicious 'Referer' header.

The IP attempted to perform Remote File Inclusion (RFI) attacks on the Apache server.

A large number of requests from a single user agent, suggesting an automated process.

The IP attempted to mark emails as read on the IMAP server without authorization.

The suspicious IP attempted to introduce spyware under the guise of software updates.

Multiple requests from different IP addresses in a short span of time, suggesting a distributed brute force attack.

Made various attempts at a forged return-path attack, attempting to spoof their source email address.

Too Many HTTP GET Requests: An unusually high number of HTTP GET requests from a single IP or a small set of IPs could indicate a DoS attack.

This IP belongs to Valero Energy.

This IP belongs to Amazon.