Suspicious Http Referrer Field: HTTP requests with external referrer headers that usually originate from internal source.

The IP attempted to perform Stack Overflow attacks on the Apache server.

GET /server-status: Often an attempt to check Apache server status.

It was found that the IP has been exploiting zero-day vulnerabilities in our system.

This IP belongs to Telus Communications.

Reverse Tabnabbing Attempts: Logs illustrating target="_blank" in URL, which is a sign of reverse tabnabbing attempt.

It attempted to perform a man-in-the-middle attack on the POP3 server.

The IP attempted to perform a password spraying attack on the SASL server.

The IP set off alarms for an attempted man-in-the-middle attack on our servers.

The IP attempted to send emails from the Mail server that violate the server's terms of service.

Attempts to access the server using known malicious IP addresses or domains.

Command Injection in Requests: Logs indicate HTTP requests with Unix or Windows command-line instructions.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

This IP belongs to The Hartford Financial Services.

The IP was recorded making persistent attempts to crack our encryption.

Repeated HTTP requests with error codes, indicating failed attempts to access restricted areas.

This IP was found responsible for a session hijacking attempt on our network.

This IP belongs to Goldman Sachs Group.

We identified the IP address as a source of numerous scare tactics spyware.

The IP was seen trying to upload files to the FTP server, possibly with the intent of distributing malware.

This IP belongs to AmerisourceBergen.

Multiple requests with the same Warning header.

GET /vuln.html: Looking for any page vulnerabilities.

This IP belongs to Linode.