POST /ckupload.php,: A threat actor attempting to exploit CKEditor’s file uploader.

Unusually high CPU usage, which can indicate a brute force attack is in progress.

Unusual User-Agent: Logs show requests with abnormal, uncommon or non-standard User-Agent strings.

This IP belongs to MetLife.

It attempted to exploit known vulnerabilities in the POP3 protocol.

This IP belongs to Wells Fargo.

This IP belongs to Vodafone.

This IP was seen trying to perform a Sniffing attack, capturing and analyzing VoIP traffic to glean sensitive information.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

This IP belongs to United Parcel Service.

Attempts to use automated scripts or tools for password cracking.

It tried to execute Privilege Escalation attacks, trying to gain higher-level access on our server.

The handler of this IP has been exploiting scumware to disrupt our users' browsing experience.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

The IP was caught attempting to execute heap overflow attacks.

The IP attempted to exploit Buffer Overflow vulnerabilities on our server.

This malicious IP was reported for trying to perform a FTP Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

It attempted to perform a man-in-the-middle attack on the SSH server.

The IP attempted to send malware-infected attachments from the Mail server.

GET /../htpasswd: Trying to access password files using directory traversal.

Multiple attempts to access the server using different ports or protocols.

This particular IP has been used in advanced persistent threats against our servers.

This IP belongs to Microsoft Azure.

The IP was seen trying to perform a Fraggle attack, a type of DDoS attack where the attacker sends a large amount of UDP traffic to a router's broadcast network.

This IP belongs to Walgreens Boots Alliance.