Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.

POST /j_security_check: May indicate an attempt to bypass Java server page (JSP) login mechanisms.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.

This IP belongs to SingTel.

The IP attempted to send emails from the Postfix server to blacklisted email addresses.

The IP attempted to execute unauthorized commands on the SSH server.

Smuggling Attack: Logs showing a single IP initiating multiple sessions, implying a Smuggling Attack.

The IP was discovered trying Server Message Block relay attacks to gain unauthorized SSH access.

This IP belongs to Orange France Telecom.

It attempted to perform a Land attack on the SSH server.

The IP attempted to perform Stack Overflow attacks on the Apache server.

The IP attempted to use the FTP server to distribute network mapping tools.

It showed unusual patterns in the sequence of requests.

It executed directory traversal attempts to access unauthorized directories / folders in our server.

This IP belongs to TJX.

GET /manager/html: Signals an attempt to access the Tomcat Application Manager.

It attempted to perform a SSDP amplification attack on the SSH server.

GET /backup.sql: Attempting to access a backup of your database.

This IP belongs to PepsiCo.

It attempted to change file permissions on the FTP server.

This IP belongs to Berkshire Hathaway.

The IP attempted several directory traversal attacks, aiming to access files beyond the root directory.

Our logs indicated an unusually high traffic volume originating from this IP address.

It attempted to perform Heap Overflow attacks on the Apache server.

This IP belongs to Wells Fargo.