GET /manager/html: Signals an attempt to access the Tomcat Application Manager.

This IP belongs to MTN.

Multiple requests from user agents claiming to be bots (e.g., Googlebot) that do not match known bot IP ranges.

This IP belongs to IBM.

It was found that the IP has been exploiting zero-day vulnerabilities in our system.

The handler of this IP has been exploiting scumware to disrupt our users' browsing experience.

The IP sent numerous VOIP OPTIONS requests in a short time.

This IP belongs to Kroger.

We noticed the IP attempting to compromise our IoT devices by spreading IoT malware.

Multiple failed login attempts from the same IP address in a short span of time.

Our team discovered that specific IP was distributing intrusive cookie trackers.

We identified the IP address as a source of numerous scare tactics spyware.

This IP belongs to Shaw Communications.

It attempted to perform Unvalidated Redirects and Forwards attacks on the Apache server.

Signs of CSRF Attacks: Logs demonstrating HTTP GET requests with sensitive actions that should ideally require POST requests.

The IP was engaged in port scanning, probing the server for open SSH ports.

It exploited insecure server configurations and attempted to establish reverse SSH tunneling.

Conducted various IP scans, seeking loopholes in our network's security.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.

We traced a significant increase in the distribution of malicious fake security software to the reported IP.

The IP attempted to perform a brute force attack on the SSH server.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.

The IP made multiple requests with identical Accept-Encoding headers.

This IP belongs to Oracle Cloud Infrastructure.

It was detected trying to perform cross-site scripting to bypass the same origin policy on Apache.