The IP attempted 'DLL Injection' to alter the server's behavior in a malicious manner.

It launched a botnet to infiltrate our Apache-DDoS service.

The IP was linked to numerous attacks using web shells through web servers.

A sudden spike in bandwidth usage, which can indicate a brute force attack.

This malicious IP was reported for trying to perform a FTP Zombie Scan, using the FTP server to mask its true location and identity.

This IP belongs to Kroger.

It exploited CVE-specific server vulnerabilities as a backdoor entrance to our mail system.

Attempts to use default or common usernames and passwords, a common tactic in brute force attacks.

Suspicious Http Referrer Field: HTTP requests with external referrer headers that usually originate from internal source.

The IP attempted code injection attacks, injecting malicious codes in HTTP headers.

The IP was detected while sending out malicious spyware-infected emails.

The IP made multiple unsuccessful login attempts to the SASL server in a short period of time.

Forceful Browsing: Attempts to access pages or resources without proper navigation.

The IP was seen trying to perform a Denial of Service (DoS) attack, attempting to make a machine or network resource unavailable to its intended users.

Multiple failed attempts to use the server’s API.

Repeated connections to the server from unknown or suspicious IP addresses.

The suspicious IP attempted to introduce spyware under the guise of software updates.

Automated Bot Traffic: Logs are showing an unusual large amount of traffic from known or suspected bot IPs.

This particular IP attempted to exploit vulnerabilities in our web applications.

The IP was involved in a traffic flooding attack, overwhelming a network's bandwidth to cause service disruption.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

This specific IP was marked for unauthorized browser changes implying browser hijackers.

It was found actively trying to exploit HTTP Response Splitting vulnerabilities to perform further attacks.

The IP attempted session sidejacking, seeking to take over SSH sessions post-authentication.

The IP was seen making repeated calls to premium-rate numbers, a common form of VoIP fraud.