It initiated various replay attacks, attempting to disrupt the system by re-transmitting legitimate data verbatim.

This IP belongs to Publix Super Markets.

Unusual activity in the server's error logs.

Conducted various IP scans, seeking loopholes in our network's security.

GET /index.php?param=: Attempting a cross-site scripting (XSS) attack.

The IP launched HTTP tunnel attacks, attempting to wrap other protocols in HTTP to bypass network filters.

HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

GET /configuration.php.old: Trying to locate backup configuration files.

It attempted to use the FTP server to distribute network scanning tools.

POST /login.jsp?user=admin&pass=admin: This could be an attempt to log in as an admin.

GET /.git/config: Trying to access source code or repository configuration information.

Multiple requests to the same endpoint in a short period of time.

GET /wp-config.php~: Requesting the backup files which may expose sensitive information.

The IP attempted to perform HTTP Request Smuggling attacks on the Apache server.

It attempted to make unauthorized calls using the Asterisk server.

It attempted to intercept SSL/TLS secured mail connections to eavesdrop or modify the passing data.

It attempted to perform a denial of service attack on the SSH server.

This IP belongs to Travelers Cos.

This IP belongs to UnitedHealth Group.

This IP was detected uploading malicious codes in our network.

Unusually high CPU usage, which can indicate a brute force attack is in progress.

The IP was seen performing a CSRF (Cross-site request forgery) attack to manipulate user actions.

This particular IP tried to perform an unauthorized system configuration change.

implemented multiple decryption attacks to gain unauthorized access to encrypted email data.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.