GET /manager/html: Signals an attempt to access the Tomcat Application Manager.

The delivery of spyware, aimed at gathering sensitive information, was originated from this IP.

The IP attempted to use the FTP server to distribute forensics tools.

The IP was seen engaging in a Slowloris attack, holding as many connections to the target web server open for as long as possible, eventually overloading the server.

The IP attempted to perform a replay attack on the SSH server.

The IP was seen attempting a SYN Flood attack, overwhelming the server by rapidly initiating a connection but not completing it, thereby consuming server resources.

The IP attempted to perform Format String attacks on the Apache server.

This IP has been observed spreading mobile malware, targeting our company application users.

The malicious IP was identified trying to leverage the Postfix service to send bulk spam emails.

It tried to create buffer overflows by sending large amounts of data at once to overwhelm server resources.

It attempted to use the FTP server to distribute botnet command and control software.

Usage of Obscure HTTP Verbs: Seeing non-standard HTTP methods like DEBUG, PUT, or CONNECT could imply a web-based attack.

It was found that the IP has been exploiting zero-day vulnerabilities in our system.

The IP attempted to login to the POP3 server with an invalid username.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

Multiple requests with the same X-Forwarded-For header.

This IP belongs to Cloudfare.

This IP belongs to AmerisourceBergen.

This IP belongs to MetLife.

HEAD /: May be part of a larger Reconnaissance.

It attempted to perform a dictionary attack on the SSH server.

This IP belongs to Wells Fargo.

the IP made attempts at wiretapping the network to monitor SSH traffic patterns and gather useful information.

It tried to execute Privilege Escalation attacks, trying to gain higher-level access on our server.

This IP belongs to Microsoft.