Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

The IP was involved in a SIP Message Tampering attack, altering SIP messages in transit to disrupt communication or gain unauthorized access.

Unknown source code changes in our system were linked back to this offensive IP address.

This IP belongs to Comcast.

This IP belongs to Publix Super Markets.

The IP attempted to manipulate data flowing to the server to cause arbitrary code execution.

The IP attempted to perform XML External Entity (XXE) attacks on the Apache server.

The IP was seen trying to perform a Denial of Service (DoS) attack, attempting to make a machine or network resource unavailable to its intended users.

The IP set off alarms for an attempted man-in-the-middle attack on our servers.

The IP attempted a pass-the-hash attack, trying to authenticate without knowing the plaintext password.

The IP was seen attempting a Dictionary attack on the FTP server, systematically entering every word in a dictionary as a password to find the correct one.

A sudden spike in bandwidth usage, which can indicate a brute force attack.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

It attempted to use the Asterisk server to perform a reflection DDoS attack.

It attempted to perform a SSDP amplification attack on the SSH server.

Numerous requests for non-existent pages, suggesting the attacker is probing for vulnerabilities.

This IP belongs to Hostgator.

The IP address attempted to exploit known vulnerabilities in the Apache server software.

The IP made multiple requests with the same Proxy-Connection header.

It participated in Unvalidated Redirects and Forwards attacks, leading users to malicious websites via altered SSH links.

The IP sent numerous VOIP OPTIONS requests in a short time.

High Frequency POST Requests: Numerous or unusual POST requests in a short time span could indicate a dictionary or brute force attack on a login page.

The IP address has been flagged for multiple attempts to deliver drive-by-download attacks.

This IP belongs to Sysco.