It made multiple requests with identical cookies.

The IP was linked to numerous attacks using web shells through web servers.

The delivery of spyware, aimed at gathering sensitive information, was originated from this IP.

It launched a SYN flood attack, aiming to consume server resources and disrupt services.

The IP attempted to perform Format String attacks on the Apache server.

GET //web-console/Invoker: Might be an attempt to access JBoss server's web console for exploitation.

DNS changer spyware originating from the flagged IP was designed to redirect our network traffic.

The IP was involved in a FTP Injection attack, exploiting vulnerabilities in the FTP server to execute unauthorized commands.

This IP belongs to NTT Docomo.

The IP address made multiple attempts to exploit a Remote File Inclusion (RFI) vulnerability.

It was responsible for an unusual increase in server CPU usage.

It attempted to perform Insecure Direct Object References attacks on the Apache server.

It sent SIP INVITE requests to non-existent extensions.

The IP made multiple unsuccessful login attempts to the SASL server in a short period of time.

It detected attempting time-based blind SQL injection, observing the server's response time to extract data.

This IP belongs to Sprint.

This IP belongs to FedEx.

It made multiple requests with identical Accept-Charset headers.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.

The IP was involved in a war dialing attack, dialing a large number of phone numbers to find modems, fax machines, and unsecured VoIP devices.

This IP belongs to Procter & Gamble.

The malicious IP engaged in distributed denial of service (DDoS) attacks, exhausting server resources and disrupting SSH services.

Repeated failed attempts to perform actions that require higher privileges.

SQL Injection in HTTP Requests: Logs record HTTP requests that contain SQL statements. Possible strings could include 'SELECT *' or 'DROP TABLE', indicative of a SQL injection attack.

The IP made repeated attempts to authenticate with the VOIP server using different usernames.