Server Scanning for Software Version: Influx of HTTP requests attempting to detect software version running on the server.

The IP set off alarms for an attempted man-in-the-middle attack on our servers.

This IP belongs to Kroger.

This IP belongs to Amazon Web Services.

The IP attempted code injection attacks, injecting malicious codes in HTTP headers.

Signal of DDoS Attacks: Multiple IP addresses sending a significantly high volume of traffic.

This IP belongs to Chevron.

It detected attempting time-based blind SQL injection, observing the server's response time to extract data.

Multiple requests with the same Proxy-Authorization header.

It attempted to perform a Teardrop attack on the SSH server.

This IP belongs to Allstate.

The IP was involved in a SIP Message Tampering attack, altering SIP messages in transit to disrupt communication or gain unauthorized access.

The IP attempted to send malware-infected attachments from the Mail server.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

This IP belongs to Anthem.

This IP belongs to WordPress.com.

This IP belongs to Boeing.

This IP addressed employed a method of brute force attack attempting to compromise our systems.

This IP was associated with targeted spear phishing attempts against our senior staff.

The IP attempted to mark emails as read on the POP3 server without authorization.

Multiple requests with the same TE (Transfer Encoding) header.

The IP initiated clickjacking exploits, causing users to unwittingly perform malicious actions during SSH sessions.

The IP attempted to download emails from the IMAP server without authorization.

The IP attempted to perform Stack Overflow attacks on the Apache server.

It attempted to flood the VOIP server with REGISTER requests.