Unusually high number of requests to a specific service or application within the server.

It launched a botnet to infiltrate our Apache-DDoS service.

Executed numerous SQL injection attacks in an attempt to manipulate the server's databases.

The IP distributed unrequested software, secretly stealing user data while posing as useful tools.

The IP attempted to send malware-infected attachments from the Mail server.

The IP attempted to exploit known vulnerabilities in the SIP protocol.

The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

It continually sought to exploit known vulnerabilities within SSH through crafted packet attempts.

It attempted to perform a RIPv1 amplification attack on the SSH server.

This malicious IP was reported for attempting to initiate a large number of simultaneous calls, a sign of a potential DDoS attack.

It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

It attempted to perform a NTP amplification attack on the SSH server.

It was detected trying to perform cross-site scripting to bypass the same origin policy on Apache.

It was noticed that the IP has tried illegal attempts of reverse engineering our software.

GET /internal/: Browsing an internal directory.

It attempted to flood the SIP server with REGISTER requests.

The IP made multiple requests to the server's robots.txt file.

This IP belongs to Oracle.

It carried out key logging attempts, hoping to record keyboard inputs during SSH sessions.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.

TLS Downgrade Attacks: Logs showing repeated attempts to establish non-TLS connections with the server.

This IP belongs to Target.

It systematically tried to exploit IMAP and POP3 vulnerabilities present in our mail service setup.

It attempted to perform a SIP Brute Force attack on the SIP, VOIP, or Asterisk server.

It attempted to perform WSDL Enumeration attacks on the Apache server.