Cross-Site Scripting (XSS): Logs show HTTP requests with string "

It attempted to exploit known vulnerabilities in the SSH protocol.

The IP attempted to download emails from the IMAP server without authorization.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

Attempts to use automated scripts or tools for password cracking.

The IP was involved in a FTP Spam attack, using the FTP server to distribute unsolicited emails or messages.

This IP belongs to Procter & Gamble.

The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

It attempted to use the FTP server to distribute terrorist propaganda.

This IP belongs to American Airlines Group.

Unusually high number of requests to a specific service or application within the server.

It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

GET /admin: Looking for an unprotected admin page.

Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.

Unusual command line activities that are not typical for the server environment.

This IP has been identified as running a botnet targeting our server systems with ransomware.

It sent unusually large VOIP packets, potentially indicating a buffer overflow attempt.

It appeared to be taking part in SSL Stripping attacks, downgrading secure HTTPS connections to facilitate eavesdropping.

This IP belongs to FedEx.

This IP belongs to World Fuel Services.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

Command Injection in Requests: Logs indicate HTTP requests with Unix or Windows command-line instructions.

It attempted to make unauthorized calls using the Asterisk server.

Multiple requests with identical cookies.

The IP targeted our server with PHP Injection attacks to gain access to sensitive data.