The IP was involved in a SIP brute force attack, attempting to guess SIP authentication credentials to gain unauthorized access.

Our system blocked an attempted Code Injection attack from this IP.

It attempted to perform a SIPVicious scan on the Asterisk server.

The IP tried to crack S/MIME encryption for accessing secured email contents.

The IP attempted to perform XML Injection attacks on the Apache server.

This IP belongs to Alibaba Cloud Services.

The IP attempted to perform ARP Spoofing attacks on the Apache server.

GET /internal/: Browsing an internal directory.

This IP belongs to Xbox Live.

It initiated a Phishing attack, making fake requests to the server pretending to be a legit user.

This IP belongs to Humana.

Multiple requests with identical POST parameters.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

Multiple requests with identical Accept-Charset headers.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

It attempted to perform a man-in-the-middle attack on the IMAP server.

GET /trace.axd: An attempt to find a debug handler in ASP.NET.

The IP actively tried code replacement attacks, swapping legitimate system call addresses with malicious ones.

This IP belongs to Walmart.

The IP was recorded making persistent attempts to crack our encryption.

The IP tried to exploit buffer overflow vulnerabilities to run unauthorized code.

This IP belongs to NetEase.

Login attempts at unusual times (e.g., in the middle of the night).

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.