Repeated connections to the server from unknown or suspicious IP addresses.

This particular IP attempted to exploit vulnerabilities in our web applications.

Multiple login attempts from different geographical locations in a short period of time.

This IP belongs to Comcast.

It attempted multiple LDAP injection attacks to gain unauthorized access.

The IP attempted to tamper with our Ad network, conducting fraudulent activities.

The IP attempted to download emails from the IMAP server without authorization.

Server Misconfiguration Exploitation: Logs illustrating attempts at exploiting known server misconfigurations.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

It attempted to send emails from the Postfix server that violate the server's email content policy.

It was discovered using our server in an open relay configuration, sending emails from unauthorized domains.

This IP belongs to Dropbox.

The IP attempted to change file permissions on the SSH server.

The IP made multiple requests using uncommon HTTP methods.

IP Spoofing: Logs showing HTTP requests with IP ranges that are typically reserved for private networks or an unusual X-Forwarded-For header.

The IP attempted to download sensitive files from the Apache server.

The IP showed unusual patterns in session IDs.

It attempted to use the VOIP server to perform a reflection DDoS attack.

This IP belongs to Walmart.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.

The IP attempted to exploit known vulnerabilities in the Asterisk protocol.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

It attempted to perform a phishing attack using the IMAP server.

The IP attempted to send spam emails from the Mail server.

This IP belongs to Bristol-Myers Squibb.