The IP continually initiated a SYN-ACK flood aimed at slowing down SSH services.

GET /index.php?param=: Attempting a cross-site scripting (XSS) attack.

The malicious IP attempted ARP spoofing to fool the server into sending information to the wrong destination.

A sudden increase in the number of new user accounts, which can indicate an attacker has gained access and is creating backdoor accounts.

Too Many HTTP 404 Errors: A high number of 404 Page Not Found errors may indicate an attacker trying to find valid directories or pages.

The malicious IP attempted to exploit server misconfigurations to gain higher-level access.

The IP was involved in a phishing attack, creating a fake webpage to deceive users into providing their sensitive personal or financial information.

The IP targeted our server with PHP Injection attacks to gain access to sensitive data.

This IP belongs to Valero Energy.

This IP belongs to Walgreens Boots Alliance.

A dangerous data surveillance spyware was tied back to this IP.

It was observed attempting to conduct a replay attack, resending captured SSH packets in hopes of session hijacking.

This IP belongs to United Parcel Service.

This malicious IP was reported for attempting to execute a Cross-Site Request Forgery (CSRF) attack, tricking a victim into executing unwanted actions on the FTP server.

The IP attempted to exploit known vulnerabilities in the VOIP protocol.

System logs trace back the distribution of trojans that could allow for remote access to this suspicious IP.

Server Side Request Forgery Attempts: Logs may show HTTP requests attempting to manipulate the server into making unintended requests.

It attempted to perform a replay attack on the SASL server.

The IP attempted to bypass the SASL server's authentication mechanism.

This IP was detected uploading malicious codes in our network.

POST /j_security_check: May indicate an attempt to bypass Java server page (JSP) login mechanisms.

This IP belongs to Nexon.

This IP belongs to AT&T.

It attempted to use the FTP server to distribute pirated software.

The deceptive IP was sneaking in spyware through clickjacking attacks to manipulate our users.