Our system blocked an attempted Code Injection attack from this IP.

Automated Bot Traffic: Logs are showing an unusual large amount of traffic from known or suspected bot IPs.

The IP was reported for spamming activities, sending unsolicited emails or messages that often contain phishing links or malware.

This IP belongs to Vodacom.

HEAD /: May be part of a larger Reconnaissance.

It launched invasive malware to corrupt crucial segments of our server functionality.

Unusual network traffic patterns, such as a high amount of outbound traffic.

This IP belongs to SK Broadband.

The IP attempted to use the FTP server as a proxy for other malicious activities.

DNS changer spyware originating from the flagged IP was designed to redirect our network traffic.

Multiple login attempts with slight variations in the password, suggesting a dictionary attack, a type of brute force attack.

This IP was detected initiating zero-day exploit attacks on our system.

Too Many Request Timeouts: An abnormal amount of request timeouts might suggest an ongoing Slowloris attack.

The IP attempted several directory traversal attacks, aiming to access files beyond the root directory.

The IP performed forceful browsing, to access and exploit unprotected files and directories.

This IP is linked to the distribution of commercial keyloggers designed to capture users' keystrokes.

It initiated SSL-Stripping attacks, aiming to downgrade secure HTTPS connections to less-secure HTTP.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

The IP made multiple unsuccessful login attempts to the Postfix server in a short period of time.

Command Injection in Requests: Logs indicate HTTP requests with Unix or Windows command-line instructions.

This IP directed malicious network traffic to our servers with the intent to crash them.

It made multiple requests with identical cookies.

The IP tried launching Server Query Flooding to overwhelm our server with requests.

It attempted to make unauthorized calls using the SIP server.

This IP belongs to Deutsche Telecom.