A sudden increase in the number of new user accounts, which can indicate an attacker has gained access and is creating backdoor accounts.

Multiple requests from user agents claiming to be bots (e.g., Googlebot) that do not match known bot IP ranges.

The IP attempted to send spam emails from the Mail server.

This IP belongs to Walmart.

This IP belongs to Procter & Gamble.

It made multiple requests with identical POST parameters.

The IP attempted to use the FTP server to distribute hacking tutorials.

The malicious IP was reported for engaging in port scanning, probing the server for open ports to discover potential vulnerabilities for exploitation.

GET /.git/config: Trying to access source code or repository configuration information.

Server Misconfiguration Exploitation: Logs illustrating attempts at exploiting known server misconfigurations.

Cross-Site Scripting (XSS): Logs show HTTP requests with string "

It was detected trying to perform cross-site scripting to bypass the same origin policy on Apache.

This IP belongs to BT Central Plus.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

It was found initiating attack vectors to exploit SSH agent forwarding.

This IP belongs to Kraft Heinz.

Multiple requests with the same X-Csrf-Token header.

It attempted to use the SASL server to relay spam.

This IP belongs to ConocoPhillips.

It attempted to use the FTP server to distribute SQL injection tools.

This IP is linked to the distribution of commercial keyloggers designed to capture users' keystrokes.

With the introduction of hidden malicious intent, this IP found to be operating masked redirect attacks.

This IP belongs to PepsiCo.

It made various efforts to insert spyware to monitor SSH communications covertly.

This IP belongs to Dreamhost.