GET /setup.php: Effort to locate setup files for PHP applications.

This IP belongs to Gilead Sciences.

It attempted to perform a man-in-the-middle attack on the SSH server.

The IP was involved in distributing malware, infecting systems or networks to steal data, cause damage, or gain unauthorized access.

The IP attempted to send emails with misleading headers from the Mail server.

The IP actively tried code replacement attacks, swapping legitimate system call addresses with malicious ones.

A string of malicious e-commerce apps installations were linked to this IP.

This IP belongs to Baidu.

The IP attempted session sidejacking, seeking to take over SSH sessions post-authentication.

Multiple requests with the same If-None-Match header.

HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

The IP attempted to use the FTP server to distribute forensics tools.

It attempted to flood the SIP server with REGISTER requests.

It attempted to login to the FTP server with an invalid password.

This IP belongs to AT&T.

It attempted to use the Postfix server to relay malware-infected attachments to other servers.

It attempted to take advantage of misconfigurations in the Apache server.

The IP attempted to send emails from the Mail server that violate the server's terms of service.

This IP belongs to Morgan Stanley.

Unusual network traffic patterns, such as a high amount of outbound traffic.

This IP was tracked while attempting to distribute secretive and malicious keyloggers.

This IP belongs to the University of California, Berkeley.

This malicious IP was reported for trying to inject malicious scripts into the VoIP server, potentially to disrupt its operation or steal data.

Multiple requests with the same Proxy-Authorization header.

Bogus pop-ups irritating our end-users were found to be released by this infamous IP.