A sudden surge in the number of requests per second, indicating an automated process.

This IP was involved in a Remote File Inclusion (RFI) attack, exploiting a vulnerability to execute malicious scripts from a remote server.

Server Scanning for Software Version: Influx of HTTP requests attempting to detect software version running on the server.

The IP engaged in DNS Spoofing, rerouting our server's lookups to a malicious destination.

This malicious IP was reported for attempting to download files from the FTP server without authorization, potentially stealing sensitive data.

The IP tried to execute Malware/Ransomware attacks via mail attachments.

Participated in malicious pranks by altering messages sent through the server.

It attempted to exploit known vulnerabilities in the Postfix software.

It was flagged initiating reflective (DRDoS) attacks, intending to exhaust our server resources.

This malicious IP was reported for attempting to perform a FTP Phishing attack, creating a fake FTP login page to deceive users into providing their credentials.

Multiple failed attempts to use the server’s API.

Multiple requests with the same If-Match header.

It initiated SSL-Stripping attacks, aiming to downgrade secure HTTPS connections to less-secure HTTP.

The IP attempted to use the SSH server to relay data to other systems.

This IP belongs to Prudential Financial.

The IP was reported for hosting a phishing website, deceiving users into providing their sensitive personal or financial information.

Multiple failed login attempts from the same IP address in a short span of time.

Repeated Unique 404 Errors: Logs revealing a steady stream of unique 404 errors could suggest a DDoS attack aiming to exhaust storage resources.

It attempted to flood the SIP server with REGISTER requests.

This IP belongs to Verizon Communications.

The IP attempted to send emails from the Mail server pretending to be from a different sender.

The IP attempted to launch Ciphertext attacks, trying to decrypt SSH-encrypted communication.

The IP attempted to perform a credential stuffing attack on the IMAP server.

The IP address attempted to stealthily spread screen scrapers, programs that take screenshots of the user's display.

Our firewall recorded intrusion attempts originating from this suspicious IP.