It launched SQL injection attempts, to break our server database through poorly secured entry fields.

Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

It made multiple requests with the same Referer header.

With the introduction of hidden malicious intent, this IP found to be operating masked redirect attacks.

It was found that the IP has been exploiting zero-day vulnerabilities in our system.

POST /xmlrpc.php: Could indicate an attempt at exploiting the WordPress xmlrpc.php file, often used for brute forcing.

Our system flagged this IP as conducting fraudulent transactions activities.

The IP attempted to perform a dictionary attack on the POP3 server.

The IP address attempted to exploit known vulnerabilities in the Apache server software.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

The IP engaged in a mail relay attack, using our server to send spam.

This IP belongs to Phillips 66.

Repeated Unique 404 Errors: Logs revealing a steady stream of unique 404 errors could suggest a DDoS attack aiming to exhaust storage resources.

It was flagged initiating reflective (DRDoS) attacks, intending to exhaust our server resources.

It attempted to flood the SIP server with REGISTER requests.

Multiple requests with the same If-Match header.

The IP made multiple requests with the same Proxy-Connection header.

This IP belongs to Gilead Sciences.

Multiple attempts to access the server using different ports or protocols.

The malicious IP was reported for attempting a SIP Proxy attack, using a SIP server to mask its true location and identity.

The IP address attempted delivering malicious packets to disrupt the system's operation.

The IP attempted to use the FTP server to distribute VPN tools.

The IP was involved in a SIP brute force attack, attempting to guess SIP authentication credentials to gain unauthorized access.

This IP blocked legitimate users by performing IP hijacking.

Multiple failed attempts to use the server’s API.