MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

The malignant IP conducted a Reflector attack, using third-party servers to amplify the attack traffic towards our server.

It initiated several reverse IP lookup requests, probing for server vulnerabilities.

This IP belongs to Morgan Stanley.

The IP engaged in DNS Spoofing, rerouting our server's lookups to a malicious destination.

The IP under scrutiny has been associated with multiple modem hijackers.

This malicious IP was reported for attempting to execute a Cross-Site Request Forgery (CSRF) attack, tricking a victim into executing unwanted actions on the FTP server.

It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

The IP address has been associated with unwanted browser toolbar installations.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

This particular IP has been used in advanced persistent threats against our servers.

The malignant IP conducted a Reflector attack, using third-party servers to amplify the attack traffic towards our server.

Multiple requests with the same Expect header.

The IP sent numerous Asterisk OPTIONS requests in a short time.

This IP belongs to Marathon Petroleum.

Malicious Script Execution: Execution attempts of suspicious scripts or encoded payloads often seen in URI parameters or request bodies.

This IP belongs to FedEx.

Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

It attempted to execute unauthorized commands on the Apache server.

This IP belongs to Prudential Financial.

The malicious IP was reported for attempting to reroute calls through the SIP server, a tactic often used to commit toll fraud.

HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

It tried to use Cross-site scripting (XSS) attacks to inject malicious scripts into webpages viewed by users.

DNS changer spyware originating from the flagged IP was designed to redirect our network traffic.