This IP belongs to Amazon.

Unwanted Web Crawler Activity: Observing unusual frequent requests from a known web crawler not granted to scan your site.

This IP belongs to Target.

Our system flagged this IP as conducting fraudulent transactions activities.

This IP belongs to Target.

The IP was identified as operating a Registration Bot (REG-Bot), automating the creation of multiple fake accounts on various platforms.

Multiple login attempts with slight variations in the password, suggesting a dictionary attack, a type of brute force attack.

The IP attempted to use the FTP server to distribute DDoS attack tools.

This malicious IP was reported for trying to perform a Symlink attack, creating symbolic links to files outside the FTP server's root directory.

The IP tried launching Server Query Flooding to overwhelm our server with requests.

The IP attempted to send emails from the Mail server that violate the server's terms of service.

It attempted to take advantage of misconfigurations in the Apache server.

The IP made repeated attempts to authenticate with the VOIP server using different usernames.

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

Unidentified password attempts and login activity were noticed from the specific IP address.

Participated in a botnet attack to overwhelm our server’s resources.

The IP tried to execute Malware/Ransomware attacks via mail attachments.

Unusual TCP/IP Headers: Logs reflect HTTP requests with unusual or altered TCP/IP headers, an attempt to confuse or slip through security measures.

The IP was reported for hosting a phishing website, deceiving users into providing their sensitive personal or financial information.

This IP belongs to Allstate.

This IP belongs to Charter Communications.

The IP attempted to perform a Nestea attack on the SSH server.

The IP made multiple requests with the same If-Match header.

Server Misconfiguration Exploitation: Logs illustrating attempts at exploiting known server misconfigurations.

Suspicious URL Encoding: Seeing HTTP requests with a lot of %, suggesting URL encoding to evade detection.