MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

The malicious IP was involved in a Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

This IP belongs to American Airlines Group.

The IP attempted to perform Directory Traversal attacks on the Apache server.

Malicious Script Execution: Execution attempts of suspicious scripts or encoded payloads often seen in URI parameters or request bodies.

It attempted to login to the FTP server with an invalid password.

The IP's involvement in spreading password stealers has compromised our network's protection.

It attempted to send emails from the Postfix server to email addresses that have previously marked emails from the server as spam.

Multiple requests with the same If-Range header.

The IP was caught distributing VoIP crackers to exploit our communication channels.

Tried to carry out a rainbow table attack, attempting to crack hashed passwords.

This particular IP attempted to exploit vulnerabilities in our web applications.

Multiple login attempts using common or easily guessable passwords (like 'password123', 'admin', etc.).

This IP belongs to Alibaba Cloud Services.

Uncommon Referer Header: HTTP logs record requests from an uncommon or suspicious 'Referer' header.

Multiple failed login attempts using different usernames.

This IP belongs to Zayo Bandwidth.

It made numerous requests to the same endpoint in a short time.

This IP belongs to Freddie Mac.

The IP set off alarms for an attempted man-in-the-middle attack on our servers.

This IP belongs to AT&T.

It attempted to perform Unvalidated Redirects and Forwards attacks on the Apache server.

It seems like this IP tried to spread malware into the network.

The IP attempted to register as a SIP user with no password.

This IP belongs to Heroku.