The IP attempted to perform a replay attack on the SSH server.

The IP made multiple requests with the same If-Match header.

The IP has initiated several exploits, specifically for software vulnerabilities.

A series of active scareware campaigns was traced back to this IP address.

We noticed the IP attempting to compromise our IoT devices by spreading IoT malware.

The IP attempted to use the SASL server to relay phishing emails.

The IP attempted to use the FTP server to distribute rootkit software.

The IP attempted to login to the SASL server with an invalid username.

Unusual patterns in the sequence of requests.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

This IP was reported for attempting a Man-in-the-Middle attack, intercepting and potentially altering communication between two parties.

This IP belongs to Bank of America.

We traced a significant increase in the distribution of malicious fake security software to the reported IP.

The IP attempted a race condition attack, aiming to execute unwanted sequences in the server.

This IP was seen trying to perform a RTP Injection attack, inserting audio into an established VoIP call.

Frequent access requests from user agents that are known to be associated with malicious tools or bots.

The IP was seen trying to exploit known vulnerabilities in server software, a common tactic for gaining unauthorized access or control.

The IP was involved in a Directory Traversal attack on the FTP server, attempting to access restricted directories and files.

The malicious IP attempted to gain unauthorized access to the server by repeatedly trying different username and password combinations.

This IP belongs to Alphabet.

It was making constant NDR (Non-Deliverable Receipt) or backscatter attacks by generating large amount of invalid email addresses.

This IP belongs to Goldman Sachs Group.

GET /setup.php: Effort to locate setup files for PHP applications.

Multiple requests with identical POST parameters.

GET /errors.log: Shows an actor trying to access server error logs.