Repeated connections to the server from unknown or suspicious IP addresses.

A majority of our user base received phishing emails originated from this particular IP address.

This IP belongs to UnitedHealth Group.

A large number of requests from a single user agent, suggesting an automated process.

It attempted to use the FTP server to distribute password recovery tools.

This IP belongs to Oracle Cloud Infrastructure.

This IP was suspected of running a botnet, a network of compromised computers used for malicious activities like spamming or DDoS attacks.

This IP belongs to KDDI.

The IP address attempted delivering malicious packets to disrupt the system's operation.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.

The IP attempted to perform a password spraying attack on the SSH server.

The IP address attempted to stealthily spread screen scrapers, programs that take screenshots of the user's display.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

It attempted to perform a Chargen amplification attack on the SSH server.

Login attempts from foreign IP addresses.

GET /CFIDE/administrator/enter.cfm: An attempt to get into the ColdFusion admin console.

TLS Downgrade Attacks: Logs showing repeated attempts to establish non-TLS connections with the server.

The IP was involved in a FTP Flood attack, sending a large number of FTP connection requests to overwhelm the server.

This IP belongs to NetEase.

It tried to force its way into a secure admin session by trying to hijack the session's cookies.

The IP address was found roaming through the network, scanning for weak spots.

This IP executed mass-probing of various ports to seek vulnerabilities.

The IP address attempted to exploit known vulnerabilities in server software.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.