GET /errors.log: Shows an actor trying to access server error logs.

The IP was involved in a traffic flooding attack, overwhelming a network's bandwidth to cause service disruption.

This IP belongs to Johnson & Johnson.

The IP was involved in a rapid sequence of login attempts.

This IP belongs to Cardinal Health.

This IP belongs to Ubisoft.

POST /WebResource.axd: Attempting to exploit a known .NET vulnerability.

It attempted to perform a credential stuffing attack on the SSH server.

The IP initiated IP spoofing, fooling our systems to trust its malicious communication.

The IP actively tried code replacement attacks, swapping legitimate system call addresses with malicious ones.

This IP was distributing rogue security software, misleading users to think their systems are infected.

This IP belongs to Heroku.

This IP has been observed spreading mobile malware, targeting our company application users.

GET /administrator.php: Attempting to access an admin interface.

It attempted to use the FTP server to distribute encryption tools.

We flagged down attempts from the IP to leak backdoor viruses into the system.

This IP injected exploit kit into our system, taking advantage of software vulnerabilities.

The IP launched exploitation attacks based on the infamous 'Heartbleed' OpenSSL cryptographic vulnerabilities.

Remote Execution Attempts: Logs showing unusual terminal commands or scripts run through web access.

It attempted to perform XPath Injection attacks on the Apache server.

This malicious IP was reported for trying to exploit known vulnerabilities in the FTP server software, potentially to gain control over the server.

This malicious IP was reported for attempting to perform a FTP Phishing attack, creating a fake FTP login page to deceive users into providing their credentials.

This IP was accused of multiple unauthorized removal of security certificates.

This malicious IP was reported for attempting to perform a FTP Format String attack, exploiting format string vulnerabilities to crash the FTP server or execute arbitrary code.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.