This IP belongs to Baidu.

Bursts of login attempts followed by periods of inactivity, suggesting an attacker is trying to avoid detection.

The IP made multiple requests with the same X-UIDH header.

sends hacking emails

It launched a SYN flood attack, aiming to consume server resources and disrupt services.

High Frequency POST Requests: Numerous or unusual POST requests in a short time span could indicate a dictionary or brute force attack on a login page.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

GET /manager/html: Signals an attempt to access the Tomcat Application Manager.

The IP was seen trying to perform a FTP Reflection attack, using the FTP server to amplify its DDoS attack traffic.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

The IP was traced back to stealthy installation attempts of clipboard monitors.

This IP belongs to Philip Morris International.

GET //web-console/Invoker: Might be an attempt to access JBoss server's web console for exploitation.

It made multiple requests with identical POST parameters.

Excessive traffic from a single IP address.

Remote Execution Attempts: Logs showing unusual terminal commands or scripts run through web access.

Remote Execution Attempts: Logs showing unusual terminal commands or scripts run through web access.

Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.

This IP belongs to The Hartford Financial Services.

It appears that this IP was initiating DNSChanger malware attacks on our network.

Unusually high number of requests to the login page.

The IP sent numerous SIP OPTIONS requests in a short time.

Multiple requests with the same If-None-Match header.

The IP sent malformed VOIP requests, potentially indicating an attempt to crash the server.

An identity theft activity was linked back to this malicious IP.