Repeated requests for the same file or page, indicating an attempt to crack a password or exploit a vulnerability.

There were several attempts from this IP to manipulate our server DNS records.

Repeated connections to the server from unknown or suspicious IP addresses.

It attempted to perform a replay attack on the SASL server.

The IP attempted to use the FTP server to distribute DDoS attack tools.

This IP belongs to Verizon Communications.

The IP attempted to use the FTP server to distribute rootkit software.

It launched a botnet to infiltrate our Apache-DDoS service.

It made multiple requests with the same If-None-Match header.

The IP attempted to send spam emails from the Postfix server.

The IP attempted to register as an Asterisk user with no password.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

Distributed session hijackers from the IP were designed to capture and exploit web browser sessions.

It appeared to be taking part in SSL Stripping attacks, downgrading secure HTTPS connections to facilitate eavesdropping.

The IP's involvement in spreading password stealers has compromised our network's protection.

The IP attempted to use the FTP server to distribute forensics tools.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

The IP made multiple requests to the server's robots.txt file.

This IP belongs to Cardinal Health.

This IP belongs to General Motors.

GET /modules/productpageadverts/uploadimage.php: This is related to a known vulnerability in the Prestashop module productpageadverts.

Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.

It attempted to use the VOIP server as a relay for calls to premium-rate numbers.

The handler of this IP has been exploiting scumware to disrupt our users' browsing experience.

It showed an unusually high number of requests to the login page.