Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

We traced a significant increase in the distribution of malicious fake security software to the reported IP.

Multiple requests with the same If-Match header.

This IP belongs to WordPress.com.

The IP was identified as operating a Registration Bot (REG-Bot), automating the creation of multiple fake accounts on various platforms.

It attempted to login to the POP3 server with an invalid password.

The IP attempted to download emails from the POP3 server without authorization.

The IP attempted to perform a VOIP Hopper scan on the VOIP server.

It attempted to perform a man-in-the-middle attack on the SSH server.

This particular IP displayed behaviour typical of a ransomware-infected system, encrypting several files.

This IP belongs to Globe Telecom.

The IP attempted to use the FTP server to distribute child pornography.

The IP attempted various header manipulation attacks, aiming to bypass spam filters.

This IP belongs to New York Life Insurance.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

It attempted to perform a Quake Network Protocol amplification attack on the SSH server.

This IP belongs to Microsoft.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

It attempted to login to the POP3 server with an invalid password.

GET /db/finance.dump: An attempt to access a database dump file.

The IP was seen making repeated calls to premium-rate numbers, a common form of VoIP fraud.

The IP attempted to create new directories on the FTP server.

The IP attempted to use the Mail server to relay spam to other servers.

It initiated a Phishing attack, making fake requests to the server pretending to be a legit user.

The IP was flagged for attempting dictionary attacks on our user accounts.