Multiple requests with the same If-Match header.

It attempted to perform Race Condition attacks on the Apache server.

The IP attempted to use the FTP server to distribute malware.

The IP attempted to perform a key exchange attack on the SSH server.

This IP was suspected of running a botnet, a network of compromised computers used for malicious activities like spamming or DDoS attacks.

This IP belongs to Nationwide.

This IP has been identified as running a botnet targeting our server systems with ransomware.

This IP belongs to Hong Kong Broadband Network.

The IP was seen trying to perform a Spoofing attack, falsifying its IP address to deceive the FTP server.

This IP was associated with targeted spear phishing attempts against our senior staff.

An alarming frequency of microphone loggers has been traced back to this IP.

The IP actively participated in snowshoe spamming, spreading its spam output across many IPs and domains to avoid detection.

It conducted an incursion on secure shell (SSH), attempting to tamper with encrypted data.

Login attempts from foreign IP addresses.

It attempted to take advantage of misconfigurations in the Apache server.

Repeated attempts to access the server using insecure or deprecated methods.

It made multiple requests with the same X-Att-Deviceid header.

This IP belongs to Anthem.

Multiple attempts to access the server using credentials of inactive or seldom-used accounts.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

Multiple requests with the same Range header.

The IP made multiple unsuccessful login attempts to the SASL server in a short period of time.

The IP was seen trying to perform a Denial of Service (DoS) attack, attempting to make a machine or network resource unavailable to its intended users.

The IP tried to perform a cross-site request forgery attack on the IMAP service.

It tried to use Cross-site scripting (XSS) attacks to inject malicious scripts into webpages viewed by users.