119.155.202.92

This IP belongs to Facebook.

This IP belongs to Walgreens Boots Alliance.

HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

This IP was reported for attempting to use the SIP server to mask its true location and identity, a common tactic in VoIP phishing attacks.

It attempted to exploit known vulnerabilities in the FTP protocol.

Our team flagged this IP for injecting harmful ActiveX codes.

This IP belongs to Shaw Communications.

This IP belongs to Microsoft.

Signs of CSRF Attacks: Logs demonstrating HTTP GET requests with sensitive actions that should ideally require POST requests.

This IP belongs to Tech Data.

This IP belongs to Citigroup.

Multiple Requests from Different IPs with Same User-Agent: This could be a signal of a coordinated attack originating from compromised machines.

We discovered attempts from the IP to install rootkit spyware to gain control over our systems.

Multiple failed attempts to use the server’s API.

It attempted to use the FTP server to distribute phishing emails.

This IP belongs to Lockheed Martin.

Multiple requests with the same If-Match header.

103.73.196.51

Multiple requests from different IP addresses in a short span of time, suggesting a distributed brute force attack.

The IP made multiple unsuccessful login attempts in a short period of time.

The IP attempted to send malware-infected attachments from the Postfix server.

This malicious IP was reported for attempting a Zero-day exploit, exploiting a software vulnerability before it's known or fixed by the vendor.

IP Spoofing: Logs showing HTTP requests with IP ranges that are typically reserved for private networks or an unusual X-Forwarded-For header.

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: request for a file often associated with an outdated version of Composer and phpunit used in a remote code execution attack.