The IP made multiple requests with the same Origin header.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

It attempted to use the FTP server to distribute zombie network tools.

This IP belongs to Ubisoft.

It attempted to use the FTP server to distribute encryption tools.

It attempted to perform IP Spoofing attacks on the Apache server.

A large number of requests from a single user agent, suggesting an automated process.

This IP belongs to Cox Communications.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.

It attempted to change file permissions on the FTP server.

This IP belongs to State Farm Insurance.

This malicious IP was reported for attempting to perform a FTP Phishing attack, creating a fake FTP login page to deceive users into providing their credentials.

It attempted to use the FTP server to distribute password recovery tools.

Our data revealed this IP distributing malicious powershell scripts.

The IP was reported for attempting a DNS Amplification attack, exploiting vulnerabilities in domain name servers to turn initially small queries into much larger payloads.

It attempted to perform a replay attack on the SASL server.

This IP belongs to BT Central Plus.

It attempted to perform Server Side Request Forgery (SSRF) attacks on the Apache server.

The IP showed unusual patterns in session IDs.

It attempted to perform a dictionary attack on the SSH server.

Multiple requests with the same Warning header.

Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.

It attempted to perform a SSDP amplification attack on the SSH server.

The IP attempted to implement a 'BlueKeep' exploit, leveraging protocol vulnerabilities to execute remote code through SSH network services.

Last night, we received an alert regarding this IP attempting to upload keyloggers to our network.