The IP made multiple requests using uncommon HTTP methods.

This IP belongs to Procter & Gamble.

Unusual patterns in referrer URLs.

Multiple requests to the server's robots.txt file.

Ping of Death: Logs showing oversized ICMP requests could suggest Ping of Death attacks.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

It attempted to perform Insecure Direct Object References attacks on the Apache server.

The IP had a series of targeted attacks distributing SpyAgents with spying functionalities.

The deceptive IP was sneaking in spyware through clickjacking attacks to manipulate our users.

The IP launched timing attacks, trying to understand our server timings for potential future exploits.

It made multiple requests with identical cookies.

We linked several cryptojacking attempts, aimed at harnessing our system resources, to this IP.

It repetitively attempted Port Scanning to identify open ports and related vulnerabilities.

Multiple failed login attempts using different usernames.

Attempts to login using a sequential list of passwords, indicating a possible brute force attack.

The IP made multiple unsuccessful login attempts to the IMAP server in a short period of time.

The IP was flagged for attempting dictionary attacks on our user accounts.

This IP belongs to Ziggo.

GET /ELMAH.axd: Attempting to exploit ELMAH (Error Logging Modules and Handlers) misconfiguration in ASP.NET sites.

Unusually high number of requests to the login page.

This IP belongs to Deutsche Telecom.

This IP belongs to AT&T.

It attempted to send phishing emails from the Mail server.

The IP sought to exploit the SSH-1 CRC32 vulnerability for expansive unauthorized access.

The IP attempted to execute unauthorized commands on the SSH server.