Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

The IP attempted to exploit known vulnerabilities in the VOIP protocol.

Our firewall recorded intrusion attempts originating from this suspicious IP.

Malformed Host Headers: HTTP requests with host headers that do not match the site's actual hostname.

The specific IP has been identified attempting to load malicious browser helper objects into the network.

It attempted to perform a brute force attack on the IMAP server.

It executed directory traversal attempts to access unauthorized directories / folders in our server.

WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.

Login Attempts with Automated User-Agents: Logs reflect requests to login page with 'bot' or 'spider' in user-agent strings.

It attempted to use the SASL server to relay spam.

Attempts to login using a sequential list of passwords, indicating a possible brute force attack.

It attempted to carry out a 'Ping of Death' operation, hoping to crash the server.

Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.

It attempted to perform Insecure Direct Object References attacks on the Apache server.

Multiple unsuccessful attempts to escalate privileges or access root account.

Our data revealed this IP distributing malicious powershell scripts.

This IP belongs to Alphabet.

Too Many HTTP GET Requests: An unusually high number of HTTP GET requests from a single IP or a small set of IPs could indicate a DoS attack.

The IP attempted to perform Directory Traversal attacks on the Apache server.

A series of unusual file transfers originated from this IP.

This IP belongs to Hostgator.

It was discovered illicitly scanning the server for potential vulnerabilities.

The IP was seen trying to exploit known vulnerabilities in the Asterisk server, a common tactic for gaining unauthorized access or control.

Attempts to access the server using unusual HTTP methods or request types.

This IP belongs to Chevron.