IP Spoofing: Logs showing HTTP requests with IP ranges that are typically reserved for private networks or an unusual X-Forwarded-For header.

This IP belongs to Tumblr.

The malicious IP attempted ARP spoofing to fool the server into sending information to the wrong destination.

It made multiple requests with the same If-None-Match header.

The malicious IP was involved in a credential stuffing attack, using stolen username-password combinations to gain unauthorized access.

The IP was flagged trying to conduct Denial of Service (DoS) attacks on the Postfix service.

The IP address has been linked to the creation of artificial traffic to crash our website.

The IP made multiple unsuccessful login attempts to the Postfix server in a short period of time.

The IP attempted to send spam emails from the Mail server.

The IP was reported for hosting a phishing website, deceiving users into providing their sensitive personal or financial information.

The IP made multiple unsuccessful login attempts to the SSH server in a short period of time.

This IP belongs to DuPont de Nemours.

Attempts to access sensitive areas of the server, such as the admin page or user account information.

The malicious IP was spotted attempting to brute-force the SSH login credentials.

The IP attempted to perform a BitTorrent amplification attack on the SSH server.

It attempted to perform a password spraying attack on the POP3 server.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

Multiple requests with the same If-None-Match header.

The IP address has been flagged for multiple attempts to deliver drive-by-download attacks.

It initiated various replay attacks, attempting to disrupt the system by re-transmitting legitimate data verbatim.

Multiple login attempts from different geographical locations in a short period of time.

It attempted to use the FTP server to distribute password cracking tools.

The IP was seen performing a CSRF (Cross-site request forgery) attack to manipulate user actions.

The IP attempted to perform a Ping of Death attack on the SSH server.

This IP belongs to New York Life Insurance.