Multiple requests with the same X-Forwarded-For header.

This IP belongs to Jabil.

A sudden increase in the number of new user accounts, which can indicate an attacker has gained access and is creating backdoor accounts.

The IP was seen engaging in a Slowloris attack, holding as many connections to the target web server open for as long as possible, eventually overloading the server.

The identified IP address was involved in planting backdoor programs that give excessive control over infected systems.

It attempted to list the contents of directories that it should not have access to.

Inclusion of Binary Data in HTTP Request: If binary data is included in the HTTP request, this could suggest an attacker is attempting a binary exploit.

The IP had been flagged for initiating SYN flood attacks on our servers.

Attempts to access the server using stolen or leaked credentials.

The IP tried to execute Malware/Ransomware attacks via mail attachments.

TLS Downgrade Attacks: Logs showing repeated attempts to establish non-TLS connections with the server.

It attempted to perform a password spraying attack on the IMAP server.

The IP attempted to perform a credential stuffing attack on the IMAP server.

This IP belongs to Tyson Foods.

It made various efforts to insert spyware to monitor SSH communications covertly.

It attempted to perform XPath Injection attacks on the Apache server.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

It attempted to perform SQL injection attacks through the Apache server.

The IP attempted to use the Mail server to relay spam to other servers.

The IP was seen trying to exploit known vulnerabilities in server software, a common tactic for gaining unauthorized access or control.

The IP targeted our server with PHP Injection attacks to gain access to sensitive data.

This IP belongs to JPMorgan Chase.

It attempted to use the FTP server to distribute terrorist propaganda.

We observed the IP distributing harmful document tracking tools.

The IP attempted to exploit known vulnerabilities in the Asterisk protocol.