Remote File Inclusion (RFI): You might see HTTP requests with "=http" or "=ftp" which can signal an attempt for remote file inclusion.

A sudden spike in bandwidth usage, which can indicate a brute force attack.

It attempted to perform a Newtear attack on the SSH server.

The IP was recorded making persistent attempts to crack our encryption.

This IP belongs to Marathon Petroleum.

Several instances of aggressive advertising spyware have been linked to this IP.

It performed botnet operations, controlling a group of “zombie” computers to amplify its DDoS attacks.

The IP attempted to use the FTP server to distribute network mapping tools.

This IP belongs to Steam.

This malicious IP was seen sending unusually high volumes of requests, a sign of potential automated bot activity.

The malicious IP was involved in a Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

This IP belongs to DuPont de Nemours.

The IP was seen attempting a FTP Command Injection attack, inserting malicious commands into legitimate FTP requests.

The IP attempted to perform a NetBIOS amplification attack on the SSH server.

The deceptive IP was sneaking in spyware through clickjacking attacks to manipulate our users.

This IP belongs to Twenty-First Century Fox.

It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

Multiple requests using HTTP methods that are not typically used (e.g., TRACE).

It attempted to perform Man in the Middle (MitM) attacks on the Apache server.

Ping of Death: Logs showing oversized ICMP requests could suggest Ping of Death attacks.

This IP belongs to Dell Technologies.

Login attempts that do not follow typical user behavior patterns.

The IP was caught distributing VoIP crackers to exploit our communication channels.

The IP initiated a 'Deauth' attack, knocking legitimate users off the Apache service.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.