Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

The IP was involved in a brute force attack on the FTP server, systematically guessing usernames and passwords to gain unauthorized access.

Probing for Hidden Files: HTTP requests for files that should not be publicly accessible could suggest an attacker probing for unsecured content.

Multiple requests with identical request parameters.

This IP belongs to Vkontakte.

Uncommon Referer Header: HTTP logs record requests from an uncommon or suspicious 'Referer' header.

It attempted to use the FTP server to distribute SQL injection tools.

This IP addressed employed a method of brute force attack attempting to compromise our systems.

Attempts to access the server using known malicious IP addresses or domains.

It attempted to send emails from the Mail server to a large number of recipients.

Bursts of login attempts followed by periods of inactivity, suggesting an attacker is trying to avoid detection.

The IP was caught distributing VoIP crackers to exploit our communication channels.

This IP belongs to General Motors.

Malformed Host Headers: HTTP requests with host headers that do not match the site's actual hostname.

It attempted to use the FTP server to distribute encryption tools.

The IP had been flagged for initiating SYN flood attacks on our servers.

This IP belongs to Shopify.

We traced a significant increase in the distribution of malicious fake security software to the reported IP.

The IP showed unusual patterns in referrer URLs.

It attempted to use the FTP server to distribute web proxy tools.

This IP belongs to Walmart.

This IP belongs to Amazon.

The IP made multiple requests with the same Via header.

The IP attempted to use the FTP server to distribute keylogging software.

Multiple attempts to access the server using credentials that were previously compromised in a data breach.