Multiple requests with the same X-Att-Deviceid header.

The IP made multiple requests with the same DNT header.

This IP belongs to American Express.

It was flagged that this IP had been used in conducting method tampering on our servers.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

It attempted to exploit known vulnerabilities in the SSH protocol.

Attempted to conduct numerous data harvesting strategies to gather sensitive user data.

It attempted to change file permissions on the FTP server.

The IP attempted to delete files from the FTP server.

This IP belongs to Walmart.

This IP belongs to CVS Health.

Frequent access requests from user agents that are known to be associated with malicious tools or bots.

The IP address attempted to register as a SIP user with an invalid username.

This malicious IP was reported for attempting to perform a FTP Format String attack, exploiting format string vulnerabilities to crash the FTP server or execute arbitrary code.

It attempted to send emails with deceptive subject lines from the Postfix server.

This IP belongs to Amazon.

A high number of unsuccessful SSH logins, a common target for brute force attacks.

It utilized Web scrapers, automatically harvesting content from our server.

POST /upload.php: An attempt to upload a possibly malicious file.

This IP was reported for attempting a Man-in-the-Middle attack, intercepting and potentially altering communication between two parties.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

GET //web-console/Invoker: Might be an attempt to access JBoss server's web console for exploitation.

This IP belongs to Apple.

It was discovered illicitly scanning the server for potential vulnerabilities.

It attempted zero-day attacks, exploiting unknown vulnerabilities in pop3.