The IP was seen trying to perform a Fraggle attack, a type of DDoS attack where the attacker sends a large amount of UDP traffic to a router's broadcast network.

Multiple requests with the same DNT (Do Not Track) header.

GET /db/finance.dump: An attempt to access a database dump file.

It attempted to use a TearDrop attack to corrupt data packets being sent to our server.

The IP made multiple requests with the same Warning header.

This IP belongs to Bank of America.

The IP was caught distributing VoIP crackers to exploit our communication channels.

The malicious IP was reported for attempting a SIP Ping attack, sending SIP OPTIONS messages to discover SIP servers or users.

The IP was seen traffic sniffing, trying to spy on and analyse network packets for potential server vulnerabilities.

This IP belongs to NetEase.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

We discovered attempts from the IP to install rootkit spyware to gain control over our systems.

The IP has been tagged as a source for data mining spyware, aiming to gather personal information.

The IP made multiple requests with identical Accept-Encoding headers.

This IP belongs to Goldman Sachs Group.

Repeated attempts to access the server using old or outdated software versions, which might have known vulnerabilities.

The IP had been flagged for initiating SYN flood attacks on our servers.

This IP belongs to Kroger.

The malicious IP tried to brute force its way into the SASL authentication process.

The IP made multiple requests with the same DNT header.

The IP sent malformed SIP requests, potentially indicating an attempt to crash the server.

The IP tried to manipulate DNS lookup processes to divert traffic to a malicious destination.

GET /internal/: Browsing an internal directory.

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

Excessive Form Submission Attempts: Numerous form submission attempts within a short time, signifying brute-force or captcha bypass attempts.