Repeated attempts to perform actions that are typically restricted, such as creating or modifying user accounts.

This IP was detected distributing spyware-infected USB drives to our users.

It attempted to use the FTP server to distribute network scanning tools.

This IP belongs to AT&T.

The IP was seen trying to perform a Fraggle attack, a type of DDoS attack where the attacker sends a large amount of UDP traffic to a router's broadcast network.

This IP belongs to Citigroup.

The malicious IP attempted ARP spoofing to fool the server into sending information to the wrong destination.

The IP attempted to send emails from the Mail server without proper authentication.

Reverse Tabnabbing Attempts: Logs illustrating target="_blank" in URL, which is a sign of reverse tabnabbing attempt.

This IP belongs to AT&T.

The IP attempted to send spam emails from the Mail server.

The IP attempted to mark emails as read on the POP3 server without authorization.

The IP was seen traffic sniffing, trying to spy on and analyse network packets for potential server vulnerabilities.

This IP belongs to Best Buy.

Multiple account lockouts in a short period of time.

Multiple failed login attempts from the same IP address.

It attempted to move emails to different folders on the IMAP server without authorization.

Usage of Obscure HTTP Verbs: Seeing non-standard HTTP methods like DEBUG, PUT, or CONNECT could imply a web-based attack.

It attempted to use the SIP server to perform a reflection DDoS attack.

The IP attempted to perform Directory Traversal attacks on the Apache server.

This IP belongs to Archer-Daniels-Midland.

This IP belongs to Telstra.

This IP belongs to Chevron.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.

The IP attempted to execute an intruder software, terrifying users with unwanted content.