It attempted to download sensitive files from the FTP server.

Attempts to access the server using credentials that have been involved in previous security incidents.

It participated in Unvalidated Redirects and Forwards attacks, leading users to malicious websites via altered SSH links.

It attempted to perform a man-in-the-middle attack on the SSH server.

The IP address generated an unusual increase in network bandwidth usage.

This IP belongs to Target.

The IP attempted to perform Integer Overflow attacks on the Apache server.

The IP made multiple unsuccessful login attempts to the IMAP server in a short period of time.

The IP was caught attempting to exploit known vulnerabilities within Postfix to gain unauthorized access.

The IP attempted to use the FTP server to distribute credit card fraud tools.

It made multiple requests with the same X-Wap-Profile header.

It attempted to perform a Sentinels amplification attack on the SSH server.

This IP belongs to America Movil.

Unusual TCP/IP Headers: Logs reflect HTTP requests with unusual or altered TCP/IP headers, an attempt to confuse or slip through security measures.

This IP belongs to General Motors.

The IP performed regular system foot printing to gain intel on weak points in our server.

The IP attempted to perform XML External Entity (XXE) attacks on the Apache server.

It launched a botnet to infiltrate our Apache-DDoS service.

This IP belongs to World Fuel Services.

It attempted to perform a denial of service attack on the SSH server.

SQL Injection in HTTP Requests: Logs record HTTP requests that contain SQL statements. Possible strings could include 'SELECT *' or 'DROP TABLE', indicative of a SQL injection attack.

Initiated a Zero-day attack, exploiting unknown vulnerabilities in our Mail and Postfix services.

This IP belongs to Nexon.

The IP made multiple unsuccessful login attempts to the Postfix server in a short period of time.

The IP made repeated attempts to authenticate with the VOIP server using different usernames.