The IP was involved in a DDoS attack, sending massive amounts of traffic to overwhelm a server and disrupt its normal functioning.

The IP attempted to send emails from the Mail server that violate the server's terms of service.

It attempted to login to the SSH server with an invalid password.

The IP attempted to perform a Nestea attack on the SSH server.

It carried out IP spoofing to mimic a trusted IP with the intent of gaining unauthorized SSH access.

It was caught injecting malicious code into the SSH session attempting to compromise server integrity.

It's observed that the IP operated a series of attacks exploiting insecure direct object references.

This IP belongs to Wells Fargo.

This malicious IP was reported for attempting a Session Hijacking attack, exploiting a valid computer session to gain unauthorized access to information or services.

Multiple requests with the same Via header.

It made multiple requests with the same X-Csrf-Token header.

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

A sudden surge in the number of requests per second, indicating an automated process.

It sent VOIP requests to non-existent extensions.

It attempted to make unauthorized calls using the SIP server.

The IP targeted our server with PHP Injection attacks to gain access to sensitive data.

Too Many HTTP GET Requests: An unusually high number of HTTP GET requests from a single IP or a small set of IPs could indicate a DoS attack.

This malicious IP was seen sending unusually high volumes of requests, a sign of potential automated bot activity.

Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.

It tried to exploit Apache Struts vulnerabilities to compromise our web applications.

This IP has been marked as the origin of numerous SQL injection attacks.

The IP made multiple requests with the same Warning header.

Initiated rogue DHCP server set up, attempting to disrupt our network and intercept emails.

GET /errors.log: Shows an actor trying to access server error logs.

The IP attempted to login to the SASL server with an invalid username.