Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

The IP initiated SYN flooding attacks, aiming to disrupt service by overwhelming the server.

Repeated failed attempts to access application interfaces or ports that are typically not open to the public.

The IP attempted to perform a credential stuffing attack on the POP3 server.

The IP was seen traffic sniffing, trying to spy on and analyse network packets for potential server vulnerabilities.

This malicious IP was reported for trying to exploit known vulnerabilities in the FTP server software, potentially to gain control over the server.

The detected IP address was responsible for the distribution of botnets aimed at automating data theft.

The IP attempted to perform a VOIP Hopper scan on the SIP server.

Our team traced back the IP responsible for multiple mobile device tracking software distributions.

This IP belongs to Cardinal Health.

Print Requests Repeatedly: Logs illustrate HTTP requests with "?print" parameter multiple times, indicating someone trying to expose sensitive information.

The IP attempted to perform a replay attack on the POP3 server.

It attempted to upload malicious scripts to the Apache server.

The IP attempted to bypass the SASL server's authentication mechanism.

This IP belongs to Globe Telecom.

A sudden surge in the number of requests per second, indicating an automated process.

This IP belongs to Softbank.

This IP belongs to Virgin Media.

The IP attempted to launch Ciphertext attacks, trying to decrypt SSH-encrypted communication.

Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

This malicious IP was reported for attempting to execute a Cross-Site Request Forgery (CSRF) attack, tricking a victim into executing unwanted actions on the FTP server.

This IP was responsible for circulating malicious images masked with spyware.

The IP tried to launch 'Dark Tequila' malware that steals banking information and login credentials from the server.

This IP belongs to United Continental Holdings.

It carried out IP spoofing to mimic a trusted IP with the intent of gaining unauthorized SSH access.