Multiple failed login attempts from the same IP address in a short span of time.

The handler of this IP has been exploiting scumware to disrupt our users' browsing experience.

This IP belongs to the University of California, Berkeley.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

Multiple Requests from Different IPs with Same User-Agent: This could be a signal of a coordinated attack originating from compromised machines.

The IP was involved in a RTP Bleeding attack, exploiting vulnerabilities in the VoIP server to listen to ongoing calls.

Uncommon Referer Header: HTTP logs record requests from an uncommon or suspicious 'Referer' header.

The IP was seen engaging in a Slowloris attack, holding as many connections to the target web server open for as long as possible, eventually overloading the server.

It attempted to exploit known vulnerabilities in the Postfix software.

It carried out IP spoofing to mimic a trusted IP with the intent of gaining unauthorized SSH access.

GET /login.action: Trying to find a Struts2 application to exploit.

It made numerous requests to the same endpoint in a short time.

The IP address attempted to login to the IMAP server with an invalid username.

The IP attempted to use the FTP server to distribute child pornography.

It attempted to use the IMAP server to relay spam.

The IP was seen trying to perform a FTP Reflection attack, using the FTP server to amplify its DDoS attack traffic.

This IP belongs to the United States Department of Defense.

It made multiple requests with identical Accept-Charset headers.

It attempted to perform Cross-Site Request Forgery (CSRF) attacks through the Apache server.

It sent SIP INVITE requests to non-existent extensions.

The IP was detected attempting to skirt our system's detection through spoofing.

It repeatedly tried to inject malicious script code into the system via appending it to an email body.

Attempted to employ SSL-bumping for a man-in-the-middle attack to decrypt our secured data.

The IP was involved in a traffic flooding attack, overwhelming a network's bandwidth to cause service disruption.

The IP attempted to flood the Apache server with requests, in a Denial of Service (DoS) attack.