Repeated attempts to use the same password across multiple accounts.

Repeated attempts to access directories or files that do not exist or are typically not accessed.

This IP belongs to Ford Motor.

This IP belongs to Virgin Media.

The specific IP has been identified attempting to load malicious browser helper objects into the network.

Several cross-site scripting attacks were traced back to this IP.

We observed the IP distributing harmful document tracking tools.

Remote File Inclusion (RFI): You might see HTTP requests with "=http" or "=ftp" which can signal an attempt for remote file inclusion.

GET /vuln.html: Looking for any page vulnerabilities.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

This IP was seen trying to perform a SIP URI Spoofing attack, falsifying the SIP URI to deceive the receiver or hide the caller's identity.

This IP was found responsible for a session hijacking attempt on our network.

This IP belongs to State Farm Insurance.

Multiple failed attempts to use the server’s API.

GET /modules/productpageadverts/uploadimage.php: This is related to a known vulnerability in the Prestashop module productpageadverts.

It attempted to login to the Mail server with an invalid password.

Probing for Hidden Files: HTTP requests for files that should not be publicly accessible could suggest an attacker probing for unsecured content.

By launching ApacheKiller attacks, the IP aimed to cause a Denial of Service by exhausting memory resources.

The IP was involved in distributing malware, infecting systems or networks to steal data, cause damage, or gain unauthorized access.

The IP tried to exploit remote file inclusion vulnerabilities, aiming to run malicious scripts on the server.

POST /j_security_check: May indicate an attempt to bypass Java server page (JSP) login mechanisms.

The IP sent numerous Asterisk OPTIONS requests in a short time.

It tried to execute Privilege Escalation attacks, trying to gain higher-level access on our server.

This IP was seen trying to perform a SIP URI Spoofing attack, falsifying the SIP URI to deceive the receiver or hide the caller's identity.

Login Attempts on Non-Existent Users: Many login requests for non-existent usernames could suggest a blind username enumeration attack.