Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

Multiple requests with the same Referer header.

This IP belongs to the United States Department of Defense.

The IP attempted to perform XML External Entity (XXE) attacks on the Apache server.

Our logs indicated an unusually high traffic volume originating from this IP address.

Repeated attempts to exploit known vulnerabilities in the server operating system or applications.

This IP belongs to PLDT.

A sudden increase in the number of new user accounts, which can indicate an attacker has gained access and is creating backdoor accounts.

Multiple requests with the same Warning header.

It attempted to perform a side channel attack on the SSH server.

This IP belongs to Allstate.

It was discovered using our server in an open relay configuration, sending emails from unauthorized domains.

The IP made multiple requests with the same If-Match header.

This malicious IP was reported for trying to perform a Routed Attack, using the FTP server as a jump point to attack another system.

It continually sought to exploit known vulnerabilities within SSH through crafted packet attempts.

It performed 'Spectre' attacks, exploiting predictive branching in CPUs to potentially gain sensitive information from the SSH service.

The IP was reported for hosting a phishing website, deceiving users into providing their sensitive personal or financial information.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

The IP attempted a race condition attack, aiming to execute unwanted sequences in the server.

The IP attempted to send emails from the Mail server that violate the server's email sending limits.

Unusual increase in server CPU usage.

This IP was suspected of running a botnet, a network of compromised computers used for malicious activities like spamming or DDoS attacks.

GET /modules/productpageadverts/uploadimage.php: This is related to a known vulnerability in the Prestashop module productpageadverts.

This IP belongs to Kraft Heinz.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.