Multiple requests with the same DNT (Do Not Track) header.

This IP belongs to Verizon.

Attempted to conduct numerous data harvesting strategies to gather sensitive user data.

Conducted various IP scans, seeking loopholes in our network's security.

It launched header-based exploits, attempting to manipulate HTTP headers to cause inappropriate server responses.

This IP belongs to Target.

This IP belongs to PepsiCo.

It attempted to carry out a dictionary attack on pop3 logins to gain unauthorized access.

IP Spoofing: Logs showing HTTP requests with IP ranges that are typically reserved for private networks or an unusual X-Forwarded-For header.

The IP attempted to implement a 'BlueKeep' exploit, leveraging protocol vulnerabilities to execute remote code through SSH network services.

This malicious IP was involved in a Clickjacking attack, tricking users into clicking on something different from what the user perceives, potentially leading to confidential information disclosure or takeover of their computer.

This IP was linked to an attempt at distributing malicious software within our system.

The IP attempted to send spam emails from the Mail server.

This IP belongs to Marathon Petroleum.

The malicious IP was reported for attempting a RTP Replay attack, capturing RTP packets and resending them to disrupt communication.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.

This IP belongs to Comcast.

Numerous requests for non-existent pages, suggesting the attacker is probing for vulnerabilities.

The malicious IP was reported for sending malformed packets to the SIP server, potentially aiming to crash the system.

It attempted to use the FTP server to distribute virus creation tools.

Attempts to access sensitive areas of the server, such as the admin page or user account information.

Multiple requests with the same X-Csrf-Token header.

Code Injection: Usage of standard codes (like Base64) to obscure attack payloads or commands.

Repeated attempts to exploit known vulnerabilities in the server operating system or applications.

GET /admin: Looking for an unprotected admin page.