Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

This IP belongs to Google Cloud Services.

The IP engaged in DNS Spoofing, rerouting our server's lookups to a malicious destination.

Repeated attempts to alter or delete log files to cover tracks.

The IP was seen attempting a FTP Smurf attack, flooding the FTP server with echo request packets to cause a denial of service.

The IP made multiple requests with the same If-Match header.

This malicious IP was reported for attempting to execute a Cross-Site Request Forgery (CSRF) attack, tricking a victim into executing unwanted actions on the FTP server.

POST /j_security_check: May indicate an attempt to bypass Java server page (JSP) login mechanisms.

It attempted to login to the SSH server with an invalid password.

Ping of Death: Logs showing oversized ICMP requests could suggest Ping of Death attacks.

The malicious IP was reported for engaging in port scanning, probing the server for open ports to discover potential vulnerabilities for exploitation.

Excessive Form Submission Attempts: Numerous form submission attempts within a short time, signifying brute-force or captcha bypass attempts.

This IP belongs to IBM Cloud Services.

This IP belongs to Massachusetts Mutual Life Insurance.

The delivery of spyware, aimed at gathering sensitive information, was originated from this IP.

The IP sent numerous VOIP OPTIONS requests in a short time.

Our system logs indicate this IP has been pushing illegitimate browser plugins into our network.

Rapid sequence of login attempts.

It was noticed that the IP has tried illegal attempts of reverse engineering our software.

The IP attempted to send emails from the Postfix server to blacklisted email addresses.

It attempted to perform Insecure Direct Object References attacks on the Apache server.

Remote File Inclusion (RFI): You might see HTTP requests with "=http" or "=ftp" which can signal an attempt for remote file inclusion.

The IP was seen making repeated calls to premium-rate numbers, a common form of VoIP fraud.

The malicious IP was reported for engaging in port scanning, probing the server for open ports to discover potential vulnerabilities for exploitation.

This IP belongs to Sprint.