MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

It attempted to perform XPath Injection attacks on the Apache server.

Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.

Multiple requests to the server's robots.txt file.

The IP attempted to use the FTP server to distribute DDoS attack tools.

The IP was seen trying to perform a Fraggle attack, a type of DDoS attack where the attacker sends a large amount of UDP traffic to a router's broadcast network.

We observed the IP distributing harmful document tracking tools.

The IP attempted to perform a SNMP amplification attack on the SSH server.

It started header injection or email injection attempts, by adding extra data into the headers and confusing the server processes.

Unusual patterns in the Accept-Language header.

It attempted to use the Postfix server to relay phishing emails to other servers.

It attempted to perform a SYN flood attack on the SSH server.

This IP was seen trying to perform a Sniffing attack, capturing and analyzing VoIP traffic to glean sensitive information.

Multiple Sequential Page Requests: Quick, sequential requests to all pages of a site could be someone scanning for vulnerabilities.

Unusual patterns in the Accept-Language header.

This IP belongs to Dell Technologies.

The IP tried to exploit remote file inclusion vulnerabilities, aiming to run malicious scripts on the server.

Our team discovered that specific IP was distributing intrusive cookie trackers.

This malicious IP was seen sending unusually high volumes of requests, a sign of potential automated bot activity.

It showed an unusually high number of requests to the login page.

Unauthorized HTTP Method Usage: Logs showing unauthorized methods being attempted on the server, like TRACE or PATCH.

It made multiple requests with the same X-Att-Deviceid header.

The IP attempted to send emails from the Postfix server without proper authentication.

It attempted to use the VOIP server as a relay for calls to premium-rate numbers.

Multiple failed login attempts from the same IP address.