HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

It initiated 'HOIC' (High Orbit Ion Cannon) to overload our Apache service with junk data.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

The IP was reported for attempting a DNS Amplification attack, exploiting vulnerabilities in domain name servers to turn initially small queries into much larger payloads.

This IP belongs to United Continental Holdings.

Path/File Enumeration: Logs show multiple HTTP requests to non-existing pages and incrementing filenames, suggesting file or path enumeration.

It attempted to perform Insecure Direct Object References attacks on the Apache server.

The IP attempted to use the Mail server to relay emails with malicious links to other servers.

The IP attempted to send emails from the Postfix server without proper authentication.

This IP belongs to General Electric.

It initiated the use of spambots, sending out large amounts of unsolicited mails from our server.

This IP was seen trying to perform a SIP Torture attack, sending malformed SIP messages to crash or degrade the performance of the server.

Repeated attempts to access rarely used or hidden services on the server.

The IP address has been involved in distributing adware to our server systems.

The IP sought to exploit the SSH-1 CRC32 vulnerability for expansive unauthorized access.

Multiple 5xx Server Error Codes: A high count of server error status codes such as '500 Internal Server Error' may suggest an attacker is probing the server's security.

Repeated failed attempts to access application interfaces or ports that are typically not open to the public.

It made multiple requests with the same Referer header.

Our team discovered that specific IP was distributing intrusive cookie trackers.

The IP attempted a DLL injection attack, hoping to execute malicious code within our SSH processes.

This IP belongs to America Movil.

This IP was linked to an attempt at distributing malicious software within our system.

It sought to exploit cross-site scripting (XSS) vulnerabilities within our mail service web interface.

This IP belongs to Archer-Daniels-Midland.

The IP attempted to perform DNS Spoofing attacks on the Apache server.