Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

The IP was seen launching a DDoS attack on the Asterisk server, overwhelming it with traffic to disrupt its normal functioning.

The malicious IP was spotted attempting to brute-force the SSH login credentials.

The IP made multiple requests with the same Via header.

GET //web-console/Invoker: Might be an attempt to access JBoss server's web console for exploitation.

This IP belongs to United Technologies.

This malicious IP was reported for trying to exploit known vulnerabilities in the FTP server software, potentially to gain control over the server.

The IP address attempted to login to the Mail server with an invalid username.

Tried to carry out a rainbow table attack, attempting to crack hashed passwords.

It attempted to perform a phishing attack using the IMAP server.

It attempted to use the POP3 server to relay phishing emails.

The IP made repeated attempts to authenticate with the SIP server using different usernames.

HTTP Request with Odd Timing: Very precisely timed HTTP requests could imply an automated tool or bot.

It's observed that the IP operated a series of attacks exploiting insecure direct object references.

This IP belongs to Marathon Petroleum.

It attempted to perform a Chargen amplification attack on the SSH server.

It attempted zero-day attacks, exploiting unknown vulnerabilities in pop3.

Unusual patterns in user agent strings.

GET /call?function=shell_exec&var=ls: Attempting remote code execution.

Incidents of privacy-invasive software floating in our network were linked to this IP.

Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

It detected attempting time-based blind SQL injection, observing the server's response time to extract data.

Multiple failed login attempts using different usernames.

The IP tried to exploit remote file inclusion vulnerabilities, aiming to run malicious scripts on the server.

It initiated the use of spambots, sending out large amounts of unsolicited mails from our server.