Unusually high number of requests to a specific service or application within the server.

This IP belongs to Goldman Sachs Group.

It attempted to use the Asterisk server as a relay for calls to premium-rate numbers.

This IP belongs to Best Buy.

The IP address initiated multiple unsuccessful login attempts.

GET /.git/config: Trying to access source code or repository configuration information.

This IP was involved in deploying stealthy credential stealers in our network.

It attempted to perform a dictionary attack on the SASL server.

It conducted Rainbow table attacks, which use precomputed tables for reversing hash functions.

Attempts to access the server using credentials that have been involved in previous security incidents.

This IP belongs to Verizon.

Multiple requests with the same Referer header.

It attempted mail bombing, trying to overwhelm our mail server with high volumes of email.

This IP belongs to Steam.

Identification of Known Vulnerabilities: Attempts to exploit known vulnerabilities related to your server application.

It attempted to upload malicious scripts to the Apache server.

It repetitively attempted Port Scanning to identify open ports and related vulnerabilities.

It attempted to use the Postfix server to relay emails with misleading headers to other servers.

It utilized Web scrapers, automatically harvesting content from our server.

This malicious IP was reported for attempting to perform a FTP Port Stealing attack, hijacking the data connection of an existing FTP session.

The IP attempted to perform a timing attack on the SSH server.

Evidence shows that the IP address has sent a number of deceptive phishing emails to our employees.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

This IP has been identified as running a botnet targeting our server systems with ransomware.

This IP belongs to Amazon Web Services.