Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

This IP belongs to CVS Health.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

This particular IP has been used in advanced persistent threats against our servers.

This IP belongs to Dow Chemical.

Smuggling Attack: Logs showing a single IP initiating multiple sessions, implying a Smuggling Attack.

Unusually high number of requests to a specific service or application within the server.

Unusual patterns in user agent strings.

Login attempts using old or outdated protocols.

This IP belongs to Nationwide.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

This IP was seen trying to perform a RTP Injection attack, inserting audio into an established VoIP call.

A series of unusual file transfers originated from this IP.

The IP was involved in attempts of defacing the Apache server website.

It sent SIP INVITE requests to non-existent extensions.

Multiple requests with the same Proxy-Authorization header.

This IP was seen trying to perform a Sniffing attack, capturing and analyzing VoIP traffic to glean sensitive information.

The IP was seen trying to perform a PASV FTP Bounce attack, misusing the passive mode to scan other hosts and ports.

The IP continually initiated a SYN-ACK flood aimed at slowing down SSH services.

GET //web-console/Invoker: Might be an attempt to access JBoss server's web console for exploitation.

The IP made multiple requests with the same Via header.

This IP belongs to General Motors.

Repeated attempts to access directories or files that do not exist or are typically not accessed.

This IP belongs to Abbott Laboratories.