A sudden surge in the number of requests per second, indicating an automated process.

This IP belongs to Marathon Petroleum.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

This IP belongs to FedEx.

This IP belongs to Deutsche Telecom.

SQL Injection in HTTP Requests: Logs record HTTP requests that contain SQL statements. Possible strings could include 'SELECT *' or 'DROP TABLE', indicative of a SQL injection attack.

This IP was involved in deploying stealthy credential stealers in our network.

It sought to exploit cross-site scripting (XSS) vulnerabilities within our mail service web interface.

Our data revealed this IP distributing malicious powershell scripts.

A sudden increase in the number of new user accounts, which can indicate an attacker has gained access and is creating backdoor accounts.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

The IP sent numerous VOIP OPTIONS requests in a short time.

The IP attempted to perform XML Attribute Blowup attacks on the Apache server.

The IP attempted to inject malicious scripts into the server hoping it would get executed.

This IP addressed employed a method of brute force attack attempting to compromise our systems.

The IP was seen launching a DDoS attack on the FTP server, overwhelming it with traffic to disrupt its normal functioning.

It partook in whaling attacks, specifically targeting high-profile users within our system.

HTTP Fingerprinting: Sequential requests that aim to identify server software types and version numbers.

It attempted to perform Server Side Request Forgery (SSRF) attacks on the Apache server.

The IP was seen traffic sniffing, trying to spy on and analyse network packets for potential server vulnerabilities.

It showed an unusually high number of requests to the login page.

This IP belongs to GitHub.

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

Repeated Unique 404 Errors: Logs revealing a steady stream of unique 404 errors could suggest a DDoS attack aiming to exhaust storage resources.

It attempted to use the FTP server to distribute SQL injection tools.