Remote Execution Attempts: Logs showing unusual terminal commands or scripts run through web access.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

The IP was found trying to maliciously clone the SSH certificates for privileged access.

This IP belongs to American Express.

The IP initiated SYN flooding attacks, aiming to disrupt service by overwhelming the server.

It attempted to send emails from the POP3 server without authorization.

It launched a botnet to infiltrate our Apache-DDoS service.

Our network security detected the IP spreading malicious macros through document files.

The IP attempted to perform a password spraying attack on the SSH server.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

It was identified as a BadBot, a type of bot that performs malicious activities.

The IP made multiple requests with the same Proxy-Connection header.

POST /WebResource.axd: Attempting to exploit a known .NET vulnerability.

The IP attempted to perform a Multicast DNS amplification attack on the SSH server.

The IP attempted to perform a SIPVicious scan on the VOIP server.

GET /.env: Attempting to access a file that may contain sensitive environment variable data.

It exploited insecure server configurations and attempted to establish reverse SSH tunneling.

The IP attempted to exploit Buffer Overflow vulnerabilities on our server.

Login attempts from foreign IP addresses.

It attempted to exploit known vulnerabilities in the FTP protocol.

This IP belongs to Nexon.

Signs of CSRF Attacks: Logs demonstrating HTTP GET requests with sensitive actions that should ideally require POST requests.

This IP belongs to Boeing.

This IP belongs to Korea Telecom.

The IP attempted to upload malicious files to the FTP server.