GET /errors.log: Shows an actor trying to access server error logs.

Multiple failed attempts to use the server’s API.

The IP attempted to perform a Ping of Death attack on the SSH server.

This IP belongs to New York Life Insurance.

The IP attempted to gain unauthorized access to the Apache server.

Cross-Site Scripting (XSS): Logs show HTTP requests with string "

It attempted to use the SSH server as a proxy for other malicious activities.

Signal of DDoS Attacks: Multiple IP addresses sending a significantly high volume of traffic.

This IP belongs to Vodacom.

It attempted to carry out a dictionary attack on pop3 logins to gain unauthorized access.

This IP belongs to General Dynamics.

This IP belongs to State Farm Insurance.

It made multiple requests with the same X-Wap-Profile header.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

This IP belongs to Pinterest.

It attempted to perform a SIPVicious scan on the SIP server.

FTP Over HTTP: Logs may show HTTP requests containing FTP commands, potentially indicating an FTP Injection attack.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

The IP attempted to use the Mail server to relay emails with misleading headers to other servers.

The IP attempted to delete files from the FTP server.

This IP belongs to Sysco.

The malicious IP was reported for attempting a SIP Ping attack, sending SIP OPTIONS messages to discover SIP servers or users.

POST /login.jsp?user=admin&pass=admin: This could be an attempt to log in as an admin.

The notorious IP attempted to distribute Banker Trojans aimed to steal financial data.

The IP attempted to send emails with misleading headers from the Mail server.