Unusual TCP/IP Headers: Logs reflect HTTP requests with unusual or altered TCP/IP headers, an attempt to confuse or slip through security measures.

This IP belongs to Northwestern Mutual.

It attempted to use the FTP server to distribute wireless cracking tools.

An identity theft activity was linked back to this malicious IP.

Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.

High Frequency POST Requests: Numerous or unusual POST requests in a short time span could indicate a dictionary or brute force attack on a login page.

This IP was reported for attempting a Teardrop attack, sending mangled IP fragments with overlapping and oversized payloads to crash the target network device.

This IP belongs to Target.

The IP attempted to perform a SIP Invite Flood on the SIP server.

Repeated attempts to use the same password across multiple accounts.

The IP attempted to send emails from the Postfix server pretending to be from a different sender.

It attempted to perform a VOIP Hopper scan on the Asterisk server.

This IP belongs to Shopify.

The IP attempted to send malware-infected attachments from the Postfix server.

It partook in whaling attacks, specifically targeting high-profile users within our system.

It attempted to perform a side channel attack on the SSH server.

The IP attempted to use the FTP server to distribute web vulnerability scanning tools.

This IP belongs to Apple.

Our system blocked an attempted Code Injection attack from this IP.

It attempted zero-day attacks, exploiting unknown vulnerabilities in pop3.

Uncommon Referer Header: HTTP logs record requests from an uncommon or suspicious 'Referer' header.

Attempts to access the server using credentials that have been involved in previous security incidents.

It persistently tried to exploit weaknesses in the SSH communication encryption.

The IP made multiple requests to the server's robots.txt file.

The IP attempted to perform a credential stuffing attack on the IMAP server.