GET /vuln.html: Looking for any page vulnerabilities.

The IP attempted to login to the Postfix server with an invalid username.

This IP belongs to Freddie Mac.

The IP attempted to upload malicious files to the FTP server.

The IP attempted to delete directories on the SSH server.

The IP address initiated attacks using DDoS, impacting our server response times.

A sudden increase in the number of new user accounts, which can indicate an attacker has gained access and is creating backdoor accounts.

This IP belongs to Kroger.

This IP belongs to Canadian Department of Defense.

It attempted to use the Asterisk server to perform a reflection DDoS attack.

The IP exhibited unusual patterns in the Accept-Language header.

It launched Smurf Attacks, trying to overload our mail server by utilizing internet host IP network links.

This particular IP attempted to exploit vulnerabilities in our web applications.

The IP was seen trying to upload files to the FTP server, possibly with the intent of distributing malware.

Unusual network traffic patterns, such as a high amount of outbound traffic.

Unauthorized Access Attempts to Admin Directories: Repeated HTTP requests to known admin directories.

It attempted to use the SIP server to perform a reflection DDoS attack.

The IP attempted to exploit a mail server's greylisting functionality to bypass spam filters.

It made multiple requests with the same X-Requested-With header.

Multiple requests with the same X-UIDH header.

Repeated requests for the same file or page, indicating an attempt to crack a password or exploit a vulnerability.

Unusual patterns in the sequence of requests.

This IP belongs to Globe Telecom.

The IP was noticed spreading RATs (remote administration tools) camouflaged as regular software.

The IP sent malformed SIP requests, potentially indicating an attempt to crash the server.