POST /WebResource.axd: Attempting to exploit a known .NET vulnerability.

It detected attempting time-based blind SQL injection, observing the server's response time to extract data.

Our system logs indicate this IP has been pushing illegitimate browser plugins into our network.

It attempted to use the FTP server to distribute phishing emails.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

A string of malicious e-commerce apps installations were linked to this IP.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

The IP was involved in attempts of defacing the Apache server website.

The IP address was found roaming through the network, scanning for weak spots.

The IP attempted to download emails from the IMAP server without authorization.

Multiple requests with the same Max-Forwards header.

The IP attempted to download sensitive files from the SSH server.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

This IP belongs to PepsiCo.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

It attempted to delete emails from the POP3 server without authorization.

This IP belongs to Netflix.

This IP belongs to Tech Data.

GET /login.action: Trying to find a Struts2 application to exploit.

Multiple failed login attempts from the same IP address.

Rapid sequence of login attempts.

It attempted to list the contents of directories that it should not have access to.

It attempted to list the contents of directories that it should not have access to.

It attempted to login to the IMAP server with an invalid password.

It was involved in the operation of a REG-Bot, a type of bot that performs automated tasks.