This IP was detected initiating zero-day exploit attacks on our system.

Multiple requests with identical Accept-Charset headers.

This IP belongs to Cardinal Health.

This IP belongs to Netflix.

This IP was tracked while attempting to distribute secretive and malicious keyloggers.

Signs of CSRF Attacks: Logs demonstrating HTTP GET requests with sensitive actions that should ideally require POST requests.

This IP belongs to Sprint.

This IP belongs to McKesson.

It attempted to perform a SSDP amplification attack on the SSH server.

The IP was involved in a FTP Fuzzing attack, sending random or malformed data to the FTP server to cause a crash or reveal vulnerabilities.

Remote Execution Attempts: Logs showing unusual terminal commands or scripts run through web access.

Repeated attempts to exploit known vulnerabilities in the server operating system or applications.

The IP made multiple requests with the same DNT header.

It attempted to login to the IMAP server with an invalid password.

Multiple 5xx Server Error Codes: A high count of server error status codes such as '500 Internal Server Error' may suggest an attacker is probing the server's security.

This IP belongs to Lowe's.

It attempted to perform a SIP Brute Force attack on the SIP, VOIP, or Asterisk server.

The IP showed unusual patterns in session IDs.

GET /configuration.php.old: Trying to locate backup configuration files.

The IP launched exploitation attacks based on the infamous 'Heartbleed' OpenSSL cryptographic vulnerabilities.

This IP belongs to Berkshire Hathaway.

Shell Injection: Logs show requests containing command line shell syntax, suggesting shell command injection.

A sudden increase in the number of new user accounts, which can indicate an attacker has gained access and is creating backdoor accounts.

The IP was found to be behind numerous fileless malware attacks.

Multiple login attempts from different geographical locations in a short period of time.