The IP attempted to delete directories on the SSH server.

This IP belongs to General Dynamics.

Our system flagged this IP as conducting fraudulent transactions activities.

Initiated rogue DHCP server set up, attempting to disrupt our network and intercept emails.

The IP attempted to inject malicious scripts into the server hoping it would get executed.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.

Multiple requests with the same If-None-Match header.

Unusually high CPU usage, which can indicate a brute force attack is in progress.

The IP address attempted to login to the IMAP server with an invalid username.

It made multiple requests with the same Max-Forwards header.

Multiple requests with the same X-Requested-With header.

The IP launched HTTP tunnel attacks, attempting to wrap other protocols in HTTP to bypass network filters.

It actively sought to exploit unpatched software within our server applications.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.

GET /.env: Attempting to access a file that may contain sensitive environment variable data.

Unusual TCP/IP Headers: Logs reflect HTTP requests with unusual or altered TCP/IP headers, an attempt to confuse or slip through security measures.

The IP was involved in a toll fraud attack, making long-distance calls without authorization, leading to high charges.

Server Side Template Injection: Suspicious input patterns aimed at coercing server-side parsers to execute injected code.

The IP made multiple requests with the same Proxy-Authorization header.

Content Sniffing: Logs reflect HTTP requests that include the Accept header with " / ", suggesting an attacker is trying to detect what types of content the server will send.

This particular IP tried to perform an unauthorized system configuration change.

This IP belongs to America Movil.

This IP executed mass-probing of various ports to seek vulnerabilities.

The IP has been distributing browser hijackers that alter the user's browsing experience without their consent.

This IP belongs to Lowe's.