Unusually high number of requests to the login page.

It attempted to perform a SIP Register Flood on the Asterisk server.

The IP attempted to perform a password spraying attack on the SSH server.

The IP performed regular system foot printing to gain intel on weak points in our server.

This IP belongs to State Farm Insurance.

Too Many HTTP GET Requests: An unusually high number of HTTP GET requests from a single IP or a small set of IPs could indicate a DoS attack.

WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.

The IP tried to crack S/MIME encryption for accessing secured email contents.

Our team discovered that specific IP was distributing intrusive cookie trackers.

It attempted to make unauthorized calls using the VOIP server.

It attempted to login to the Mail server with an invalid password.

A series of active scareware campaigns was traced back to this IP address.

It attempted to perform XML Entity Expansion attacks on the Apache server.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

Multiple attempts to access the server using different ports or protocols.

There were several attempts from this IP to manipulate our server DNS records.

Multiple requests to the password reset page.

This IP belongs to ConocoPhillips.

It was flagged initiating reflective (DRDoS) attacks, intending to exhaust our server resources.

This IP belongs to Berkshire Hathaway.

It sent Asterisk requests to non-existent extensions.

Numerous requests for non-existent pages, suggesting the attacker is probing for vulnerabilities.

This IP belongs to Telkom SA.

This IP belongs to Korea Telecom.

This IP belongs to Amazon Web Services.