Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.

This IP belongs to Citigroup.

The IP attempted to perform Security Misconfiguration attacks on the Apache server.

Our data indicates this IP has performed data breaches by launching phishing attacks.

The IP attempted to launch Ciphertext attacks, trying to decrypt SSH-encrypted communication.

It attempted to use the Asterisk server to perform a reflection DDoS attack.

This IP belongs to Dell Technologies.

Server Side Request Forgery Attempts: Logs may show HTTP requests attempting to manipulate the server into making unintended requests.

This IP belongs to New York Life Insurance.

It attempted to perform XPath Injection attacks on the Apache server.

Code Injection: Usage of standard codes (like Base64) to obscure attack payloads or commands.

The IP partook in Drive-by attacks, embedding malicious scripts on benign websites.

Unusual patterns in the sequence of requests.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

This IP has been linked to numerous occurrences of spyware distribution within our networks.

This IP belongs to Freddie Mac.

It exploited insecure server configurations and attempted to establish reverse SSH tunneling.

The IP attempted to exploit Buffer Overflow vulnerabilities on our server.

Multiple requests with the same X-Wap-Profile header.

It attempted to use the Postfix server to relay phishing emails to other servers.

It attempted to perform a Teardrop attack on the SSH server.

Multiple requests with the same Expect header.

The IP attempted to exploit a mail server's greylisting functionality to bypass spam filters.

It attempted to login to the SSH server with an invalid password.

The IP attempted to perform Security Misconfiguration attacks on the Apache server.