Too Many Request Timeouts: An abnormal amount of request timeouts might suggest an ongoing Slowloris attack.

Server Misconfiguration Exploitation: Logs illustrating attempts at exploiting known server misconfigurations.

This IP belongs to Canadian Department of Defense.

The IP made multiple requests with the same Proxy-Connection header.

Signs of CSRF Attacks: Logs demonstrating HTTP GET requests with sensitive actions that should ideally require POST requests.

The IP address initiated attacks using DDoS, impacting our server response times.

This IP belongs to Cloudfare.

GET /index.php?param=: Attempting a cross-site scripting (XSS) attack.

POST /modules/raptor_file_manager/upload.php: Attempt to use a known flaw in the Raptor file manager for arbitrary file upload.

Attempts to access the server using unusual HTTP methods or request types.

This IP belongs to Home Depot.

It engaged in a click fraud operation using our server’s communication channels.

The IP was engaged in port scanning, probing the server for open SSH ports.

This IP belongs to Northwestern Mutual.

Multiple requests with the same If-None-Match header.

This IP belongs to Ford Motor.

It attempted to use the SIP server to perform a reflection DDoS attack.

The identified IP address was involved in planting backdoor programs that give excessive control over infected systems.

Attempts to use automated scripts or tools for password cracking.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

It tried to exploit Apache Struts vulnerabilities to compromise our web applications.

The IP address generated an unusual increase in network bandwidth usage.

This malicious IP was reported for attempting a man-in-the-middle attack on the VoIP server, intercepting and potentially altering communication.

This IP belongs to Baidu.

It attempted to use the FTP server to distribute pirated software.