The IP was involved in attempts of defacing the Apache server website.

This IP belongs to NTT Docomo.

It attempted to use the FTP server to distribute traffic monitoring tools.

This IP was reported for attempting to use the SIP server to mask its true location and identity, a common tactic in VoIP phishing attacks.

The IP attempted to perform HTTP Request Smuggling attacks on the Apache server.

Multiple requests with the same If-Match header.

HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

Multiple requests with identical request parameters.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

Repeated pings or probe requests to the server, indicating a potential reconnaissance effort before the attack.

This IP was linked to an attempt at distributing malicious software within our system.

It was flagged initiating reflective (DRDoS) attacks, intending to exhaust our server resources.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

It attempted multiple LDAP injection attacks to gain unauthorized access.

It attempted to perform a Steam protocol amplification attack on the SSH server.

The IP made multiple unsuccessful login attempts to the Mail server in a short period of time.

DNS changer spyware originating from the flagged IP was designed to redirect our network traffic.

This malicious IP was reported for attempting a FTP Bounce attack, exploiting the FTP protocol's proxy command to scan ports and networks.

This IP belongs to Fannie Mae.

The notorious IP attempted to distribute Banker Trojans aimed to steal financial data.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

This IP belongs to PepsiCo.

This IP belongs to Kroger.

Our technical team unearthed the IP's involvement in distributing malicious mobile spyware.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.