Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

Repeated pings or probe requests to the server, indicating a potential reconnaissance effort before the attack.

The IP was found trying to maliciously clone the SSH certificates for privileged access.

Unusual increase in network bandwidth usage.

It attempted to perform Session Prediction attacks on the Apache server.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

The IP was caught trying to overload the server through a Distributed Denial of Service attack.

The IP attempted to send emails from the Postfix server to blacklisted email addresses.

This IP belongs to Facebook.

This IP belongs to Pfizer.

Multiple requests with identical request parameters.

The IP made multiple unsuccessful login attempts to the Mail server in a short period of time.

This IP belongs to WordPress.com.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

This IP belongs to Exxon Mobil.

The IP attempted to tamper with our Ad network, conducting fraudulent activities.

It attempted phishing scams by sending malicious mails through compromised accounts.

The IP was involved in a SIPVicious attack, a specific type of VoIP attack that scans for open SIP servers and then attempts to crack their passwords.

The IP made multiple requests with the same Warning header.

This IP belongs to Hostgator.

The IP attempted to bypass IP blacklisting by rapidly changing its IP address.

This IP belongs to Bristol-Myers Squibb.

The IP was seen trying to exploit known vulnerabilities in server software, a common tactic for gaining unauthorized access or control.

It attempted to flood the SIP server with REGISTER requests.

The IP was marked trying to carry out Backscatter spam by replying to spam using the server's configuration.