Multiple requests with the same X-Requested-With header.

Unusual patterns in user agent strings.

Multiple requests with the same If-None-Match header.

This IP belongs to United Parcel Service.

This IP belongs to General Motors.

GET /internal/: Browsing an internal directory.

The IP attempted to register as a SIP user with no password.

It made multiple requests with the same Expect header.

The malicious IP was reported for engaging in port scanning, probing the server for open ports to discover potential vulnerabilities for exploitation.

It was flagged initiating reflective (DRDoS) attacks, intending to exhaust our server resources.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

This IP belongs to Verizon Communications.

The IP address attempted to stealthily spread screen scrapers, programs that take screenshots of the user's display.

This IP belongs to Vkontakte.

Multiple attempts to access the server using different ports or protocols.

The IP was seen trying to perform a Spoofing attack, falsifying its IP address to deceive the FTP server.

It initiated requests to non-existent endpoints.

This IP belongs to AmerisourceBergen.

The IP was detected while sending out malicious spyware-infected emails.

It launched Spoofing attacks, trying to hide its identity by disguising itself as a trusted user or server.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

The IP was involved in a brute force attack on the FTP server, systematically guessing usernames and passwords to gain unauthorized access.

This IP blocked legitimate users by performing IP hijacking.

It attempted to perform XML Entity Expansion attacks on the Apache server.

The IP was involved in a FTP Flood attack, sending a large number of FTP connection requests to overwhelm the server.