Unusual patterns in referrer URLs.

GET /etc/passwd: An attempt to retrieve Linux server user account details.

Because of numerous attacks using malicious mobile code, this IP has been blacklisted.

HTTP Fingerprinting: Sequential requests that aim to identify server software types and version numbers.

This IP belongs to Tech Data.

Server Side Template Injection: Suspicious input patterns aimed at coercing server-side parsers to execute injected code.

It attempted to move emails to different folders on the IMAP server without authorization.

The IP was involved in a FTP Fuzzing attack, sending random or malformed data to the FTP server to cause a crash or reveal vulnerabilities.

The malicious IP was involved in a vishing attack, using the VoIP server to deceive users into revealing sensitive information.

Unwanted Web Crawler Activity: Observing unusual frequent requests from a known web crawler not granted to scan your site.

This IP belongs to Xbox Live.

The IP sent numerous SIP OPTIONS requests in a short time.

It attempted to perform a denial of service attack on the SSH server.

This IP belongs to Microsoft.

The IP initiated clickjacking exploits, causing users to unwittingly perform malicious actions during SSH sessions.

Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

The IP attempted to use the FTP server to distribute ransomware.

Multiple requests with the same Warning header.

Attempted to conduct numerous data harvesting strategies to gather sensitive user data.

Unusual patterns in session IDs.

The IP made multiple requests using uncommon HTTP methods.

This IP belongs to Comcast.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

Multiple requests with identical request parameters.

Attempts to login using a sequential list of passwords, indicating a possible brute force attack.