Repeated attempts to alter or delete log files to cover tracks.

The IP attempted Forceful Browsing, trying to discover hidden directories or files which could contain SSH access data.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

The IP attempted to send emails from the Mail server that violate the server's email sending limits.

Multiple requests to the server's robots.txt file.

It attempted to login to the FTP server with an invalid password.

This IP belongs to Archer-Daniels-Midland.

This IP belongs to Wells Fargo.

It was discovered illicitly scanning the server for potential vulnerabilities.

The IP has initiated several exploits, specifically for software vulnerabilities.

It attempted to perform a phishing attack using the POP3 server.

It tried to execute Privilege Escalation attacks, trying to gain higher-level access on our server.

This IP belongs to Softbank.

This IP belongs to McKesson.

This IP belongs to Mondelez International.

The IP was identified as operating a Registration Bot (REG-Bot), automating the creation of multiple fake accounts on various platforms.

This IP belongs to the United States Department of Defense.

It attempted to use the SIP server to perform a reflection DDoS attack.

The IP launched Ping Flood attacks as a detrimental strategy to overwhelm server resources.

It attempted to perform a VOIP Hopper scan on the Asterisk server.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

Too Many Request Timeouts: An abnormal amount of request timeouts might suggest an ongoing Slowloris attack.

Multiple requests with identical request parameters.

The IP was seen trying to exploit known vulnerabilities in server software, a common tactic for gaining unauthorized access or control.