Multiple requests with the same X-Att-Deviceid header.

The IP made repeated attempts to authenticate with the SIP server using different usernames.

The malicious IP was involved in a SQL Injection attack, attempting to manipulate a database for unauthorized access or data theft.

This IP belongs to Shaw Communications.

The IP initiated IP spoofing, fooling our systems to trust its malicious communication.

GET /wp-login.php: Indicating an attempt to access a WordPress login page.

This IP belongs to McKesson.

It was identified as a BadBot, a type of bot that performs malicious activities.

The IP attempted to use the SSH server to relay data to other systems.

It initiated several reverse IP lookup requests, probing for server vulnerabilities.

This IP belongs to Sprint.

It made successive tries to alter SMTP relay configurations to send unsolicited emails.

Multiple requests with the same X-Csrf-Token header.

The malicious IP was reported for attempting unauthorized logins to the FTP server, potentially to gain access to sensitive files.

The IP address generated an unusual increase in network bandwidth usage.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

Multiple requests to the server's robots.txt file.

It repeatedly attempted to run server-side injection attacks, trying to execute malicious code on our server.

The IP initiated a man-in-the-middle (MitM) attack, attempting to capture sensitive information during legitimate email exchange.

The IP attempted fileless malware attacks, directly injecting malicious script into server memory.

It was found that the IP had deployed rogue security software in our system.

Forceful Browsing: Attempts to access pages or resources without proper navigation.

It attempted to perform a VOIP Hopper scan on the Asterisk server.

The malicious IP attempted ARP spoofing to fool the server into sending information to the wrong destination.

This malicious IP was reported for trying to perform a Symlink attack, creating symbolic links to files outside the FTP server's root directory.