Fileless malware dissemination has been observed from this IP address.

Multiple unsuccessful attempts to escalate privileges or access root account.

The IP attempted to login to the Postfix server with an invalid username.

This IP belongs to Archer-Daniels-Midland.

It attempted to use the Asterisk server to perform a reflection DDoS attack.

POST /login.jsp?user=admin&pass=admin: This could be an attempt to log in as an admin.

Unusual patterns in the Accept-Language header.

It was caught injecting malicious code into the SSH session attempting to compromise server integrity.

It attempted to use the FTP server to distribute network scanning tools.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.

This IP belongs to Hong Kong Broadband Network.

This IP belongs to Exxon Mobil.

Unexpected HTTP Methods Usage: Frequent HTTP TRACE method attempts could be an attempt to intercept network requests.

A sudden surge in the number of requests per second, indicating an automated process.

Attempts to use automated scripts or tools for password cracking.

The IP attempted to bypass the SASL server's authentication mechanism.

The IP attempted to exploit known vulnerabilities in the SIP protocol.

It attempted to use the VOIP server as a relay for calls to premium-rate numbers.

The IP sent numerous Asterisk OPTIONS requests in a short time.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.

The IP initiated SYN flooding attacks, aiming to disrupt service by overwhelming the server.

Repeated attempts to access the server using old or outdated software versions, which might have known vulnerabilities.

The IP made multiple unsuccessful login attempts to the SSH server in a short period of time.

It attempted to login to the IMAP server with an invalid password.

Our system logs indicate this IP has been pushing illegitimate browser plugins into our network.