Signs of CSRF Attacks: Logs demonstrating HTTP GET requests with sensitive actions that should ideally require POST requests.

It attempted to upload malicious files to the SSH server.

The IP attempted to use the FTP server to distribute ransomware.

The malicious IP was reported for attempting a RTP Replay attack, capturing RTP packets and resending them to disrupt communication.

The IP tried to launch 'Dark Tequila' malware that steals banking information and login credentials from the server.

Executed email spoofing attempts pretending to be a trusted party.

Unusually high number of requests to the login page.

The IP attempted to send emails from the Mail server without proper authentication.

It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

The IP attempted to perform a credential stuffing attack on the POP3 server.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

This IP belongs to MetLife.

Remote Execution Attempts: Logs showing unusual terminal commands or scripts run through web access.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

Reverse Tabnabbing Attempts: Logs illustrating target="_blank" in URL, which is a sign of reverse tabnabbing attempt.

This IP belongs to Dell Technologies.

The IP attempted to perform a QOTD amplification attack on the SSH server.

It was responsible for an unusual increase in server CPU usage.

This IP belongs to Gilead Sciences.

The IP was detected while sending out malicious spyware-infected emails.

It made multiple requests with the same X-Csrf-Token header.

This IP belongs to Gilead Sciences.

This IP belongs to Boeing.

The IP address attempted to exploit known vulnerabilities in the Apache server software.

This IP belongs to Northwestern Mutual.