The IP was involved in a rapid sequence of login attempts.

This IP was reported for attempting to register a large number of SIP extensions in a short time, a sign of a potential brute force attack.

This IP belongs to Cox Communications.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

Unusual command line activities that are not typical for the server environment.

The deceptive IP was sneaking in spyware through clickjacking attacks to manipulate our users.

This IP belongs to The Walt Disney Company.

This IP belongs to Wikimedia Foundation.

GET /administrator.php: Attempting to access an admin interface.

Multiple requests with the same X-Att-Deviceid header.

This IP belongs to Netflix.

The IP address has been linked to the creation of artificial traffic to crash our website.

This IP belongs to Alphabet.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

Multiple requests with identical POST parameters.

This IP belongs to Time Warner Cable Internet.

This IP belongs to Deutsche Telecom.

This IP belongs to Dreamhost.

It initiated a Phishing attack, making fake requests to the server pretending to be a legit user.

The IP attempted to perform a credential stuffing attack on the POP3 server.

The IP attempted to perform a Ping of Death attack on the SSH server.

It made multiple requests with the same X-Att-Deviceid header.

Multiple requests with the same Proxy-Connection header.

The IP attempted to perform a replay attack on the POP3 server.

This IP belongs to Amazon.