Too Many Request Timeouts: An abnormal amount of request timeouts might suggest an ongoing Slowloris attack.

The IP tried to initiate DNS tunneling for smuggling data through SSH.

This IP belongs to JPMorgan Chase.

It attempted to use the FTP server to relay data to other systems.

This IP was detected distributing spyware-infected USB drives to our users.

GET /call?function=shell_exec&var=ls: Attempting remote code execution.

This IP belongs to Charter Communications.

GET /.env: Attempting to access a file that may contain sensitive environment variable data.

Multiple requests with the same Range header.

Repeated attempts to use the same password across multiple accounts.

The IP attempted to send emails from the Postfix server to blacklisted email addresses.

The IP attempted to perform a SNMP amplification attack on the SSH server.

Our team traced back the IP responsible for multiple mobile device tracking software distributions.

The IP attempted to use the FTP server to distribute hacking tutorials.

The IP conducted exhaustive dictionary attacks, trying to guess password and username combinations.

GET /server-status: Often an attempt to check Apache server status.

This IP belongs to Airtel.

This IP belongs to Nationwide.

It was found actively trying to exploit HTTP Response Splitting vulnerabilities to perform further attacks.

It tried to execute Privilege Escalation attacks, trying to gain higher-level access on our server.

The notorious IP attempted to distribute Banker Trojans aimed to steal financial data.

Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

TLS Downgrade Attacks: Logs showing repeated attempts to establish non-TLS connections with the server.

The IP launched HTTP tunnel attacks, attempting to wrap other protocols in HTTP to bypass network filters.

This IP belongs to Chevron.