The IP was flagged for attempting dictionary attacks on our user accounts.

The IP has been caught trying to deliver spyware into our system to compromise sensitive data.

This IP belongs to Boeing.

Signal of DDoS Attacks: Multiple IP addresses sending a significantly high volume of traffic.

It launched header-based exploits, attempting to manipulate HTTP headers to cause inappropriate server responses.

This IP belongs to Honeywell International.

It made multiple requests with the same Referer header.

Multiple attempts to access the server using credentials that were previously compromised in a data breach.

Actively performed packet spoofing, obscuring the origin point of its own malicious packets.

Actively performed packet spoofing, obscuring the origin point of its own malicious packets.

This IP belongs to Alphabet.

This IP belongs to American Airlines Group.

This IP belongs to GitHub.

Repeated attempts to access the server using encrypted or obfuscated data, which can indicate an attacker is trying to hide their activities.

It made multiple requests with identical POST parameters.

Suspicious URL Encoding: Seeing HTTP requests with a lot of %, suggesting URL encoding to evade detection.

Rapid sequence of login attempts.

Actively performed packet spoofing, obscuring the origin point of its own malicious packets.

It attempted to download sensitive files from the FTP server.

This IP was detected uploading malicious codes in our network.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

Repeated attempts to exploit known vulnerabilities in server software.

This IP was suspected of running a botnet, a network of compromised computers used for malicious activities like spamming or DDoS attacks.

GET /modules/productpageadverts/uploadimage.php: This is related to a known vulnerability in the Prestashop module productpageadverts.

The malignant IP conducted a Reflector attack, using third-party servers to amplify the attack traffic towards our server.