Multiple requests with the same If-Range header.

Repeated Unique 404 Errors: Logs revealing a steady stream of unique 404 errors could suggest a DDoS attack aiming to exhaust storage resources.

The IP address generated an unusual increase in network bandwidth usage.

The IP attempted to perform a Multicast DNS amplification attack on the SSH server.

This IP belongs to Cigna.

Damaging activities showing connections to rootkit attacks were associated with this IP.

FTP Over HTTP: Logs may show HTTP requests containing FTP commands, potentially indicating an FTP Injection attack.

This IP belongs to Morgan Stanley.

The IP attempted fileless malware attacks, directly injecting malicious script into server memory.

The IP attempted to tamper with our Ad network, conducting fraudulent activities.

Malformed Host Headers: HTTP requests with host headers that do not match the site's actual hostname.

GET /administrator.php: Attempting to access an admin interface.

This IP belongs to Amazon.

The IP attempted to perform Session Hijacking attacks on the Apache server.

The IP initiated fake traffic attacks to manipulate webpage rankings and conduct click fraud.

This IP belongs to DuPont de Nemours.

This IP belongs to General Electric.

The IP attempted to send emails from the Mail server that violate the server's terms of service.

The IP made multiple requests with the same Origin header.

The IP attempted to send malware-infected attachments from the Mail server.

A sudden surge in the number of requests per second, indicating an automated process.

The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

This IP belongs to Amazon.

The malicious IP was involved in a credential stuffing attack, using stolen username-password combinations to gain unauthorized access.

The IP was involved in a Caller ID Spoofing attack, falsifying the caller ID to deceive the receiver or hide the caller's identity.