Multiple failed attempts to use the server’s API.

Multiple requests to the same endpoint in a short period of time.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

This malicious IP was reported for attempting to perform a FTP Port Stealing attack, hijacking the data connection of an existing FTP session.

Multiple requests with the same X-Requested-With header.

It tried to execute dictionary attacks on our Mail service causing potential delays.

This IP belongs to IBM.

The IP attempted to perform a password spraying attack on the SSH server.

This IP belongs to Telkom SA.

GET /manager/html: Signals an attempt to access the Tomcat Application Manager.

This IP belongs to New York Life Insurance.

It attempted to send emails from the Mail server that violate the server's usage policy.

The IP made multiple unsuccessful login attempts to the SSH server in a short period of time.

The IP was actively engaged in spear-phishing attacks, aimed at high-ranking officials within our network.

It attempted to use the Asterisk server as a relay for calls to premium-rate numbers.

The IP was reported for hosting a phishing website, deceiving users into providing their sensitive personal or financial information.

Unauthorized HTTP Method Usage: Logs showing unauthorized methods being attempted on the server, like TRACE or PATCH.

The IP initiated SYN flooding attacks, aiming to disrupt service by overwhelming the server.

An alarming frequency of microphone loggers has been traced back to this IP.

It tried to create buffer overflows by sending large amounts of data at once to overwhelm server resources.

High network traffic at unusual times, suggesting an automated process is running.

This IP belongs to Philip Morris International.

udden increase in account lockouts due to multiple failed login attempts.

It attempted to perform a credential stuffing attack on the SASL server.

This IP belongs to Sprint.