Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

Tried to perform a man-in-the-middle attack to intercept and alter communication between the server and clients.

This particular IP tried to perform an unauthorized system configuration change.

User-mode rootkits, originating from the particular IP, were causing system instability and crashes.

Unknown source code changes in our system were linked back to this offensive IP address.

Multiple attempts to access the server using anonymous or generic user accounts.

The IP address initiated multiple unsuccessful login attempts.

It attempted to perform Local File Inclusion (LFI) attacks on the Apache server.

GET /trace.axd: An attempt to find a debug handler in ASP.NET.

The IP attempted to download sensitive files from the Apache server.

The IP attempted to perform a BitTorrent amplification attack on the SSH server.

The IP attempted to perform Stack Overflow attacks on the Apache server.

It made multiple requests with the same If-None-Match header.

It attempted to execute unauthorized commands on the Apache server.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

The IP attempted to perform a distributed denial of service attack on the SSH server.

The IP attempted to perform a Bonk attack on the SSH server.

The malicious IP was involved in a vishing attack, using the VoIP server to deceive users into revealing sensitive information.

Suspicious URL Encoding: Seeing HTTP requests with a lot of %, suggesting URL encoding to evade detection.

This IP belongs to Cloudfare.

It attempted to exploit known vulnerabilities in the Mail protocol.

The IP attempted to use the Mail server to relay spam to other servers.

Multiple failed login attempts using different usernames.

The IP made multiple requests with the same TE header.

It attempted to use the FTP server to distribute botnet command and control software.