The IP address generated an unusual increase in network bandwidth usage.

Multiple requests with the same Max-Forwards header.

GET /configuration.php.old: Trying to locate backup configuration files.

Fileless malware dissemination has been observed from this IP address.

It attempted to flood the Asterisk server with REGISTER requests.

The IP attempted to perform Symlink attacks on the Apache server.

The malicious IP attempted to brute-force the .htaccess file to gain unauthorized administrative access.

It attempted to perform Heap Overflow attacks on the Apache server.

This IP belongs to Microsoft.

Usage of Obscure HTTP Verbs: Seeing non-standard HTTP methods like DEBUG, PUT, or CONNECT could imply a web-based attack.

The IP attempted to send emails from the Postfix server that violate the server's terms of service.

The IP attempted to send emails with misleading headers from the Mail server.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

This IP belongs to McKesson.

GET /backup.sql: Attempting to access a backup of your database.

It attempted to perform a SIP Brute Force attack on the SIP, VOIP, or Asterisk server.

This IP belongs to New York Life Insurance.

The IP executed URL Obscuring, hiding malicious URLs within seemingly innocent mail links.

Multiple requests with the same If-None-Match header.

The IP maliciously used packet sniffers in attempts to decode SSH traffic.

This IP belongs to PepsiCo.

Repeated attempts to exploit known vulnerabilities in the server operating system or applications.

Unusual patterns in session IDs.

This IP belongs to Swisscom.

GET /manager/html: Signals an attempt to access the Tomcat Application Manager.