Attempts to access sensitive areas of the server, such as the admin page or user account information.

It initiated SSL-Stripping attacks, aiming to downgrade secure HTTPS connections to less-secure HTTP.

Unusual increase in server CPU usage.

Malformed Host Headers: HTTP requests with host headers that do not match the site's actual hostname.

It was found that the IP has been exploiting zero-day vulnerabilities in our system.

The IP made multiple requests with the same X-UIDH header.

This IP belongs to American Airlines Group.

It attempted to perform a man-in-the-middle attack on the IMAP server.

It attempted to use the SIP server to perform a reflection DDoS attack.

This malicious IP was involved in a Clickjacking attack, tricking users into clicking on something different from what the user perceives, potentially leading to confidential information disclosure or takeover of their computer.

It attempted to use a TearDrop attack to corrupt data packets being sent to our server.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

Too Many HTTP 404 Errors: A high number of 404 Page Not Found errors may indicate an attacker trying to find valid directories or pages.

The IP address has been involved in distributing adware to our server systems.

The IP launched HTTP tunnel attacks, attempting to wrap other protocols in HTTP to bypass network filters.

This malicious IP was reported for attempting a Session Hijacking attack, exploiting a valid computer session to gain unauthorized access to information or services.

Attempts to access the server using known malicious IP addresses or domains.

The IP address attempted to stealthily spread screen scrapers, programs that take screenshots of the user's display.

The IP was linked to numerous attacks using web shells through web servers.

High Frequency POST Requests: Numerous or unusual POST requests in a short time span could indicate a dictionary or brute force attack on a login page.

It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

The IP launched Ping Flood attacks as a detrimental strategy to overwhelm server resources.

POST /upload.php: An attempt to upload a possibly malicious file.

GET /.git/config: Trying to access source code or repository configuration information.