Login attempts that do not follow typical user behavior patterns.

This IP belongs to TJX.

The IP was discovered trying Server Message Block relay attacks to gain unauthorized SSH access.

Multiple requests with the same Max-Forwards header.

The IP attempted to list the contents of directories that it should not have access to.

The IP was caught attempting to execute heap overflow attacks.

This IP belongs to Comcast.

It attempted to perform XML Entity Expansion attacks on the Apache server.

The IP attempted to download sensitive files from the Apache server.

It detected attempting time-based blind SQL injection, observing the server's response time to extract data.

The IP attempted to use the FTP server to distribute VPN tools.

It made multiple requests with the same X-Att-Deviceid header.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

The IP made repeated attempts to authenticate with the Asterisk server using different usernames.

It attempted to perform a NTP amplification attack on the SSH server.

It started header injection or email injection attempts, by adding extra data into the headers and confusing the server processes.

Probing for Hidden Files: HTTP requests for files that should not be publicly accessible could suggest an attacker probing for unsecured content.

It attempted to perform HTTP Response Splitting attacks on the Apache server.

???-????? https://zelenka.guru/articles/

This IP belongs to Medium.

The IP was involved in a toll fraud attack, making long-distance calls without authorization, leading to high charges.

The IP attempted to perform a brute force attack on the SSH server.

GET /muieblackcat: This is often a precursor for additional scanning and likely attacks.

Unauthorized HTTP Method Usage: Logs showing unauthorized methods being attempted on the server, like TRACE or PATCH.

This malicious IP was reported for attempting a Sniffing attack, capturing and analyzing FTP traffic to glean sensitive information.