Suspicious Http Referrer Field: HTTP requests with external referrer headers that usually originate from internal source.

This IP address from an unusual location has successfully installed malware on our servers.

The IP was involved in a RTP Bleeding attack, exploiting vulnerabilities in the VoIP server to listen to ongoing calls.

Our records indicate the IP spread multiple executable infector spyware causing system malfunction.

The IP was involved in a FTP Anonymity attack, exploiting anonymous FTP access to upload or download files without detection.

The IP attempted to manipulate data flowing to the server to cause arbitrary code execution.

The IP attempted a pass-the-hash attack, trying to authenticate without knowing the plaintext password.

This IP belongs to New York Life Insurance.

The IP address has been flagged for multiple attempts to deliver drive-by-download attacks.

The IP engaged in DNS Spoofing, rerouting our server's lookups to a malicious destination.

The IP attempted to perform Format String attacks on the Apache server.

The malicious IP was reported for attempting a SIP Ping attack, sending SIP OPTIONS messages to discover SIP servers or users.

The IP was flagged for attempting dictionary attacks on our user accounts.

This IP belongs to Dreamhost.

This IP belongs to AT&T.

Multiple requests with the same X-Att-Deviceid header.

It attempted to perform Web Service attacks on the Apache server.

This malicious IP was reported for attempting to initiate a large number of simultaneous calls, a sign of a potential DDoS attack.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

This IP belongs to AmerisourceBergen.

The IP attempted to perform a Ping of Death attack on the SSH server.

There were several attempts from this IP to manipulate our server DNS records.

Server Side Request Forgery Attempts: Logs may show HTTP requests attempting to manipulate the server into making unintended requests.

The IP was found trying to maliciously clone the SSH certificates for privileged access.

The IP was involved in a FTP Anonymity attack, exploiting anonymous FTP access to upload or download files without detection.