Unusual activity in the server's error logs.

Too Many HTTP GET Requests: An unusually high number of HTTP GET requests from a single IP or a small set of IPs could indicate a DoS attack.

The IP attempted to perform a BitTorrent amplification attack on the SSH server.

GET /configuration.php.old: Trying to locate backup configuration files.

It attempted to use the FTP server to distribute SQL injection tools.

It attempted to login to the SSH server with an invalid password.

The IP sent numerous SIP OPTIONS requests in a short time.

Unusual increase in server CPU usage.

The IP attempted to use the Mail server to relay malware-infected attachments to other servers.

It initiated SSL-Stripping attacks, aiming to downgrade secure HTTPS connections to less-secure HTTP.

The malicious IP was found to be running an Internet Relay Chat (IRC) bot, potentially spreading malware or launching Distributed Denial-of-Service (DDoS) attacks.

It attempted zero-day attacks, exploiting unknown vulnerabilities in pop3.

Code Injection: Usage of standard codes (like Base64) to obscure attack payloads or commands.

Multiple requests to the password reset page.

The malicious IP was reported for attempting unauthorized logins to the FTP server, potentially to gain access to sensitive files.

It attempted to use the FTP server to distribute network scanning tools.

Unusually high number of requests to a specific service or application within the server.

GET /vuln.html: Looking for any page vulnerabilities.

The IP address attempted to login to the FTP server with an invalid username.

The IP attempted to perform a QOTD amplification attack on the SSH server.

Multiple requests with identical request parameters.

GET /vuln.html: Looking for any page vulnerabilities.

This malicious IP was reported for attempting to perform a FTP Format String attack, exploiting format string vulnerabilities to crash the FTP server or execute arbitrary code.

It tried to execute Privilege Escalation attacks, trying to gain higher-level access on our server.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.