Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

This IP belongs to Boeing.

The malicious IP was reported for trying to perform a VoIP Phreaking attack, exploiting weaknesses in VoIP systems to make free calls or disrupt services.

This IP was responsible for circulating malicious images masked with spyware.

Multiple requests with the same Proxy-Connection header.

It tried to create buffer overflows by sending large amounts of data at once to overwhelm server resources.

It attempted multiple LDAP injection attacks to gain unauthorized access.

Unusual patterns in session IDs.

The IP made multiple requests with the same TE header.

The IP was involved in a war dialing attack, dialing a large number of phone numbers to find modems, fax machines, and unsecured VoIP devices.

Multiple requests with the same Via header.

This IP was tracked while attempting to distribute secretive and malicious keyloggers.

Bogus pop-ups irritating our end-users were found to be released by this infamous IP.

It attempted to perform a man-in-the-middle attack on the POP3 server.

This malicious IP was reported for trying to perform a FTP Zombie Scan, using the FTP server to mask its true location and identity.

Because of numerous attacks using malicious mobile code, this IP has been blacklisted.

It launched Smurf Attacks, trying to overload our mail server by utilizing internet host IP network links.

The IP tried to exploit buffer overflow vulnerabilities to run unauthorized code.

It actively sought to exploit unpatched software within our server applications.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

It attempted to make unauthorized calls using the SIP server.

It showed unusual patterns in the sequence of requests.

It attempted to perform a dictionary attack on the SSH server.

It attempted to intercept SSL/TLS secured mail connections to eavesdrop or modify the passing data.

This IP was seen trying to perform a SIP Torture attack, sending malformed SIP messages to crash or degrade the performance of the server.