POST /login.jsp?user=admin&pass=admin: This could be an attempt to log in as an admin.

Distributed session hijackers from the IP were designed to capture and exploit web browser sessions.

GET /axis2/axis2-admin/login: Attempt at finding Axis2 web service exploitable applications.

This IP belongs to Airtel.

The IP sent malformed Asterisk requests, potentially indicating an attempt to crash the server.

The IP tried to exploit buffer overflow vulnerabilities to run unauthorized code.

Signs of CSRF Attacks: Logs demonstrating HTTP GET requests with sensitive actions that should ideally require POST requests.

This IP belongs to United Continental Holdings.

It tried to force its way into a secure admin session by trying to hijack the session's cookies.

It performed 'Spectre' attacks, exploiting predictive branching in CPUs to potentially gain sensitive information from the SSH service.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

It was found that the IP has been exploiting zero-day vulnerabilities in our system.

This IP belongs to the University of California, Berkeley.

It tried to execute a Rainbow Table attack, aiming to break the encryption used in SSH password protection.

GET /vuln.html: Looking for any page vulnerabilities.

Unusual command line activities that are not typical for the server environment.

This IP was involved in deploying stealthy credential stealers in our network.

GET /manager/html: Signals an attempt to access the Tomcat Application Manager.

Last night, we received an alert regarding this IP attempting to upload keyloggers to our network.

The IP address has been associated with unwanted browser toolbar installations.

It made multiple requests with the same X-Wap-Profile header.

Multiple requests with identical Accept-Encoding headers.

GET /.env: Attempting to access a file that may contain sensitive environment variable data.

This IP belongs to Hostgator.

Multiple requests with the same If-Range header.