It engaged in a click fraud operation using our server’s communication channels.

Unusually high number of requests to a specific service or application within the server.

POST /xmlrpc.php: Could indicate an attempt at exploiting the WordPress xmlrpc.php file, often used for brute forcing.

The IP attempted to register with the Asterisk server using an invalid username.

This IP belongs to Amazon Web Services.

This IP belongs to Anthem.

The IP attempted a Rootkit installation to gain root access and control server activity.

Multiple attempts to access the server using credentials that were previously compromised in a data breach.

Our logs indicated an unusually high traffic volume originating from this IP address.

This IP belongs to Dell Technologies.

The IP engaged in an HTTP Desync attack, misaligning HTTP request and responses to yield SSH vulnerability.

Attempted to employ SSL-bumping for a man-in-the-middle attack to decrypt our secured data.

Excessive traffic from a single IP address.

Our team flagged this IP for injecting harmful ActiveX codes.

Code Injection: Usage of standard codes (like Base64) to obscure attack payloads or commands.

Identification of Known Vulnerabilities: Attempts to exploit known vulnerabilities related to your server application.

A sudden surge in the number of requests per second, indicating an automated process.

This IP belongs to Marathon Petroleum.

This IP belongs to Softbank.

Our data revealed this IP distributing malicious powershell scripts.

It attempted to delete emails from the IMAP server without authorization.

This IP belongs to Honeywell International.

Repeated attempts to alter or delete log files to cover tracks.

This IP belongs to Caterpillar.

It attempted to perform a brute force attack on the POP3 server.