Repeated attempts to alter or delete log files to cover tracks.

The IP made multiple requests with the same TE header.

This IP belongs to General Electric.

It tried to force its way into a secure admin session by trying to hijack the session's cookies.

Attempted to conduct numerous data harvesting strategies to gather sensitive user data.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.

It attempted to use the Asterisk server as a relay for calls to premium-rate numbers.

This IP belongs to Exxon Mobil.

The suspicious IP attempted to introduce spyware under the guise of software updates.

This IP belongs to TIAA.

It attempted to perform Insecure Direct Object References attacks on the Apache server.

The IP made multiple requests with the same Via header.

It tried to execute a Rainbow Table attack, aiming to break the encryption used in SSH password protection.

The malicious IP was reported for attempting to manipulate file permissions on the FTP server, potentially to gain unauthorized access or expose sensitive data.

The IP was noted for executing SYN flood attacks, purposefully creating half-open connections to deplete server resources.

The IP attempted to perform a SIP Register Flood on the VOIP server.

It launched header-based exploits, attempting to manipulate HTTP headers to cause inappropriate server responses.

This IP belongs to Netflix.

The IP was reported for hosting a phishing website, deceiving users into providing their sensitive personal or financial information.

GET /administrator.php: Attempting to access an admin interface.

Suspicious URL Encoding: Seeing HTTP requests with a lot of %, suggesting URL encoding to evade detection.

It made multiple requests with the same X-Csrf-Token header.

This IP belongs to Google Cloud Services.

The IP attempted to send malware-infected attachments from the Postfix server.

This IP was involved in deploying stealthy credential stealers in our network.