Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

Unexpected HTTP Methods Usage: Frequent HTTP TRACE method attempts could be an attempt to intercept network requests.

Multiple requests with identical POST parameters.

Attempts to use privileged service accounts outside of their normal usage patterns.

It carried out key logging attempts, hoping to record keyboard inputs during SSH sessions.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

Finally, the IP was caught in the act of Abandoned Object attacks, creating objects with no reference to exhaust memory space

This IP was implicated in attempts to inject ransomware into our systems.

Executed numerous SQL injection attacks in an attempt to manipulate the server's databases.

This IP belongs to Target.

Numerous requests for non-existent pages, suggesting the attacker is probing for vulnerabilities.

The IP was involved in a war dialing attack, dialing a large number of phone numbers to find modems, fax machines, and unsecured VoIP devices.

Repeated attempts to exploit known vulnerabilities in the server operating system or applications.

Multiple requests to the server's robots.txt file.

The IP attempted to perform Format String attacks on the Apache server.

Attempts to use privileged service accounts outside of their normal usage patterns.

Malicious Script Execution: Execution attempts of suspicious scripts or encoded payloads often seen in URI parameters or request bodies.

Tried to perform a man-in-the-middle attack to intercept and alter communication between the server and clients.

This IP belongs to KDDI.

The IP attempted to perform Symlink attacks on the Apache server.

This IP belongs to Dow Chemical.

This IP belongs to Virgin Media.

This IP belongs to Mondelez International.

It executed blind command injection, exploiting server inputs to gain unauthorized system control.

The IP attempted to download emails from the IMAP server without authorization.