Multiple requests with identical POST parameters.

Server Side Template Injection: Suspicious input patterns aimed at coercing server-side parsers to execute injected code.

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: request for a file often associated with an outdated version of Composer and phpunit used in a remote code execution attack.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

This IP was reported for attempting to register a large number of SIP extensions in a short time, a sign of a potential brute force attack.

It attempted to make unauthorized calls using the VOIP server.

System logs have traced multiple cases of our servers being bombed with trojans to this IP.

GET /axis2/axis2-admin/login: Attempt at finding Axis2 web service exploitable applications.

Multiple requests with the same TE (Transfer Encoding) header.

Login attempts that do not follow typical user behavior patterns.

This IP belongs to Walgreens Boots Alliance.

The IP attempted to perform HTTP Request Smuggling attacks on the Apache server.

We flagged down attempts from the IP to leak backdoor viruses into the system.

This IP belongs to Mondelez International.

It attempted to use the SASL server to distribute malware.

The IP attempted to perform a VOIP Hopper scan on the VOIP server.

This IP belongs to Telkom SA.

The IP was involved in a brute force attack on the FTP server, systematically guessing usernames and passwords to gain unauthorized access.

The IP was seen attempting a Dictionary attack on the FTP server, systematically entering every word in a dictionary as a password to find the correct one.

The IP conducted exhaustive dictionary attacks, trying to guess password and username combinations.

It actively sought to exploit unpatched software within our server applications.

Excessive Form Submission Attempts: Numerous form submission attempts within a short time, signifying brute-force or captcha bypass attempts.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

It utilized Web scrapers, automatically harvesting content from our server.

The IP was recorded making persistent attempts to crack our encryption.