Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

This IP belongs to Amazon Web Services.

Our system logs indicate this IP has been pushing illegitimate browser plugins into our network.

Our network security detected the IP spreading malicious macros through document files.

The IP attempted to delete files from the FTP server.

Multiple failed login attempts using different usernames.

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.

Made various attempts at a forged return-path attack, attempting to spoof their source email address.

The IP was caught trying to overload the server through a Distributed Denial of Service attack.

The IP performed Covert Timing Channel attacks, gathering information about encrypted SSH traffic by analyzing packet timing.

The IP was seen launching a DDoS attack on the Asterisk server, overwhelming it with traffic to disrupt its normal functioning.

It exploited CVE-specific server vulnerabilities as a backdoor entrance to our mail system.

Multiple requests with identical request parameters.

It attempted to perform a dictionary attack on the SASL server.

The IP has been distributing browser hijackers that alter the user's browsing experience without their consent.

It attempted to perform WSDL Enumeration attacks on the Apache server.

It made multiple requests with identical Accept-Charset headers.

Multiple failed attempts to use the server’s API.

It appeared to be taking part in SSL Stripping attacks, downgrading secure HTTPS connections to facilitate eavesdropping.

It attempted to flood the Asterisk server with REGISTER requests.

With the introduction of hidden malicious intent, this IP found to be operating masked redirect attacks.

The IP was seen trying to perform a TDoS (Telephony Denial of Service) attack, flooding the VoIP server with calls to make it unavailable to users.

This IP belongs to Cigna.

POST /upload.php: An attempt to upload a possibly malicious file.