Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

This IP was reported for attempting a Teardrop attack, sending mangled IP fragments with overlapping and oversized payloads to crash the target network device.

This IP belongs to Cigna.

This IP belongs to Medium.

It attempted to download sensitive files from the FTP server.

The IP made multiple requests with the same Origin header.

Multiple Requests from Different IPs with Same User-Agent: This could be a signal of a coordinated attack originating from compromised machines.

This IP belongs to Globe Telecom.

A large number of requests from a single user agent, suggesting an automated process.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

Multiple requests with the same Warning header.

It attempted to list the contents of directories that it should not have access to.

Multiple requests with the same X-Forwarded-For header.

This IP belongs to Sky Broadband.

This IP belongs to Pfizer.

The IP was seen attempting a FTP Command Injection attack, inserting malicious commands into legitimate FTP requests.

We linked several cryptojacking attempts, aimed at harnessing our system resources, to this IP.

Participated in a botnet attack to overwhelm our server’s resources.

It attempted to use the FTP server to distribute web proxy tools.

The IP engaged in an HTTP Desync attack, misaligning HTTP request and responses to yield SSH vulnerability.

The IP address initiated multiple unsuccessful login attempts.

This IP belongs to Proximus.

Unusually high number of requests to the login page.

This IP belongs to Swisscom.

This IP belongs to Vkontakte.