Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

The notorious IP attempted to distribute Banker Trojans aimed to steal financial data.

This IP belongs to Johnson & Johnson.

It attempted to use the FTP server to distribute password recovery tools.

It made successive tries to alter SMTP relay configurations to send unsolicited emails.

The IP address attempted to login to the FTP server with an invalid username.

The detected IP address was responsible for the distribution of botnets aimed at automating data theft.

This IP belongs to Nationwide.

This IP belongs to Marathon Petroleum.

It attempted to carry out a 'Ping of Death' operation, hoping to crash the server.

It attempted to perform XML Entity Expansion attacks on the Apache server.

Multiple requests with the same Via header.

The IP actively participated in snowshoe spamming, spreading its spam output across many IPs and domains to avoid detection.

Path/File Enumeration: Logs show multiple HTTP requests to non-existing pages and incrementing filenames, suggesting file or path enumeration.

This IP was found responsible for a session hijacking attempt on our network.

Signal of DDoS Attacks: Multiple IP addresses sending a significantly high volume of traffic.

It attempted to perform a man-in-the-middle attack on the IMAP server.

It made multiple attempts to initiate malicious File Transfer Protocol (FTP) sessions with the Postfix service.

This malicious IP was reported for attempting to perform a FTP Port Stealing attack, hijacking the data connection of an existing FTP session.

The IP made multiple requests to the password reset page.

The IP actively participated in snowshoe spamming, spreading its spam output across many IPs and domains to avoid detection.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

It made multiple attempts to initiate malicious File Transfer Protocol (FTP) sessions with the Postfix service.

This IP belongs to Archer-Daniels-Midland.

The IP attempted to use the FTP server to distribute malware.