Forceful Browsing: Attempts to access pages or resources without proper navigation.

Repeated attempts to alter or delete log files to cover tracks.

We linked several cryptojacking attempts, aimed at harnessing our system resources, to this IP.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

The IP was seen trying to perform a PASV FTP Bounce attack, misusing the passive mode to scan other hosts and ports.

The IP showed unusual patterns in session IDs.

This IP belongs to Shopify.

A high number of unsuccessful SSH logins, a common target for brute force attacks.

Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

This IP belongs to Walgreens Boots Alliance.

This IP belongs to JPMorgan Chase.

It attempted to carry out a 'Ping of Death' operation, hoping to crash the server.

The IP tried to exploit buffer overflow vulnerabilities to run unauthorized code.

A high number of unsuccessful SSH logins, a common target for brute force attacks.

This IP belongs to Bank of America.

It attempted to login to the FTP server with an invalid password.

The IP attempted to send emails from the Postfix server to blacklisted email addresses.

This IP belongs to the United States Department of Defense.

Made various attempts at a forged return-path attack, attempting to spoof their source email address.

The IP attempted to perform Symlink attacks on the Apache server.

This IP belongs to NetEase.

The IP attempted to gain unauthorized access to the Apache server.

This IP belongs to Cisco Systems.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.