Side Channel Attacks: Repeated requests aimed at inferring sensitive information through observation of web responses.

This malicious IP was reported for trying to perform a Man-in-the-Middle attack, intercepting and potentially altering communication between the FTP server and its clients.

The IP attempted to use the FTP server as a proxy for other malicious activities.

It attempted to flood the VOIP server with REGISTER requests.

The IP attempted to perform Stack Overflow attacks on the Apache server.

The IP attempted to download emails from the IMAP server without authorization.

Unusual Query String Patterns: Repeated HTTP requests with minor alterations to the query string data, signifying an attacker mapping out how different inputs affect the response.

This IP belongs to DuPont de Nemours.

The IP made multiple requests with the same Warning header.

The IP initiated clickjacking exploits, causing users to unwittingly perform malicious actions during SSH sessions.

Multiple requests with the same TE (Transfer Encoding) header.

The IP attempted to mark emails as read on the POP3 server without authorization.

GET /vuln.html: Looking for any page vulnerabilities.

With the introduction of hidden malicious intent, this IP found to be operating masked redirect attacks.

This IP was associated with targeted spear phishing attempts against our senior staff.

This IP addressed employed a method of brute force attack attempting to compromise our systems.

It attempted to use the FTP server to distribute encryption tools.

The IP attempted to use the FTP server to distribute anonymizing tools.

It initiated a Phishing attack, making fake requests to the server pretending to be a legit user.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

This IP belongs to Boeing.

This IP gave off a red flag for hosting a hidden command and control server for malicious bots.

Server Scanning for Software Version: Influx of HTTP requests attempting to detect software version running on the server.

GET /etc/passwd: An attempt to retrieve Linux server user account details.

The IP made multiple requests using uncommon HTTP methods.