Last updated Tue, 14 Apr 2026 11:04:24 (Australia/Brisbane)
Below is a list of the top 500 IP addresses with suspicious activity observed by SCARD. Click on an IP address below for more information about its activity.
Note: Due to the overwhelming number of common scan types, this list omits typical scan types in favour of less-seen threat types.
Back to top
Below is a list of the top 200 threat types observed across the network.
| Description | Incidence |
|---|---|
| ET INFO Session Traversal Utilities for NAT (STUN Binding Response) | 15372 |
| ET HUNTING Suspicious Chmod Usage in URI (Inbound) | 5040 |
| ET SCAN LeakIX Inbound User-Agent | 4559 |
| ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182) | 3650 |
| ET SCAN WordPress Scanner Performing Multiple Requests to Windows Live Writer XML | 3574 |
| ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body | 3331 |
| ET WEB_SERVER WebShell Generic - wget http - POST | 2571 |
| ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173) | 2523 |
| ET EXPLOIT Apache HTTP Server - Path Traversal Attempt (CVE-2021-42013) M2 | 2312 |
| ET EXPLOIT D-Link DSL-2750B - OS Command Injection | 2145 |
| ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) | 2145 |
| ET HUNTING Javascript Sandbox Escape via Global Object (process) | 2063 |
| SERVER-WEBAPP D-Link DSL-2750B routers login.cgi command injection attempt | 1927 |
| ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response | 1632 |
| SERVER-OTHER tcpdump ISAKMP parser buffer overflow attempt | 1525 |
| ET INFO Netlink GPON Login Attempt (GET) | 1487 |
| ET INFO External Oracle T3 Requests Inbound | 1435 |
| SURICATA HTTP Host header invalid | 1328 |
| ET INFO Request for Visual Studio Code sftp.json - Possible Information Leak | 1218 |
| ET INFO SSH-2.0-Go version string Observed in Network Traffic | 1147 |
| ET HUNTING Request for Webshell in .well-known directory | 1120 |
| ET WEB_SERVER WEB-PHP phpinfo access | 978 |
| ET SCAN Rapid POP3S Connections - Possible Brute Force Attack | 919 |
| ET SCAN Behavioral Unusually fast Terminal Server Traffic Potential Scan or Infection (Inbound) | 888 |
| SURICATA TCP invalid option length | 853 |
| ET INFO Apache Solr System Information Request | 791 |
| ET SCAN Mirai Variant User-Agent (Inbound) | 790 |
| ET INFO Python aiohttp User-Agent Observed Inbound | 780 |
| SERVER-WEBAPP React Server Components remote code execution attempt | 776 |
| ET SCAN SFTP/FTP Password Exposure via sftp-config.json | 774 |
| SURICATA IKE invalid proposal | 699 |
| SURICATA TCP header length too small | 698 |
| ET VOIP INVITE Message Flood UDP | 611 |
| SERVER-WEBAPP TP-Link Archer Router command injection attempt | 576 |
| ET EXPLOIT HackingTrio UA (Hello, World) | 561 |
| ET SCAN Nmap Scripting Engine User-Agent Detected (Nmap Scripting Engine) | 550 |
| ET EXPLOIT GraphQL Introspection Query Attempt | 546 |
| ET WEB_SERVER WGET Command Specifying Output in HTTP Headers | 535 |
| ET EXPLOIT D-Link Devices Home Network Administration Protocol Command Execution | 533 |
| ET INFO Spring Boot Actuator Health Check Request | 499 |
| ET EXPLOIT Netgear DGN Remote Command Execution | 482 |
| ET EXPLOIT Realtek SDK - Command Execution/Backdoor Access Inbound (CVE-2021-35394) | 479 |
| ET SCAN Web Scanner - Fuzz Faster U Fool (Inbound) | 464 |
| SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt | 411 |
| ET SCAN Laravel Debug Mode Information Disclosure Probe Inbound | 374 |
| SURICATA QUIC error on data | 357 |
| ET DNS Query to a *.top domain - Likely Hostile | 356 |
| ET WEB_SERVER /etc/passwd Detected in URI | 322 |
| ET VOIP Modified Sipvicious Asterisk PBX User-Agent | 315 |
| SURICATA HTTP request field missing colon | 298 |
| ET EXPLOIT MVPower DVR Shell UCE | 289 |
| ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) | 289 |
| ET INFO Observed DNS Query to .cfd TLD | 282 |
| SURICATA Applayer Unexpected protocol | 268 |
| SURICATA Applayer No TLS after STARTTLS | 268 |
| ET SCAN Potential SSH Scan OUTBOUND | 260 |
| SURICATA SMB malformed request dialects | 258 |
| ET SCAN JAWS Webserver Unauthenticated Shell Command Execution | 246 |
| ET SCAN NETWORK Incoming Masscan detected | 229 |
| SURICATA DHCP truncated options | 220 |
| ET VOIP Possible Inbound VOIP Scan/Misuse With User-Agent Zoiper | 196 |
| SURICATA STREAM ESTABLISHED packet out of window | 183 |
| SURICATA HTTP METHOD terminated by non-compliant character | 174 |
| ET WEB_SPECIFIC_APPS Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Default Credentials | 174 |
| ET SCAN Behavioral Unusual Port 1433 traffic Potential Scan or Infection | 169 |
| ET INFO Observed DNS Query to .nexus TLD | 168 |
| ET WEB_SERVER PHP tags in HTTP POST | 160 |
| SERVER-WEBAPP PHPUnit PHP remote code execution attempt | 154 |
| ET SCAN NMAP OS Detection Probe | 152 |
| ET WEB_SERVER Likely Malicious Request for /proc/self/environ | 128 |
| SURICATA HTTP invalid request field folding | 122 |
| ET WEB_SERVER Wordpress Login Bruteforcing Detected | 122 |
| SURICATA ICMPv4 invalid checksum | 114 |
| SURICATA SMTP duplicate fields | 109 |
| ET WEB_SPECIFIC_APPS Vite Arbitrary File Read Via raw parameter (CVE-2025-30208) | 100 |
| ET USER_AGENTS WinRM User Agent Detected - Possible Lateral Movement | 96 |
| SURICATA FRAG IPv4 Fragmentation overlap | 95 |
| ET HUNTING Suspicious PHP Code in HTTP POST (Outbound) | 88 |
| ET WEB_SERVER allow_url_include PHP config option in uri | 85 |
| ET WEB_SERVER auto_prepend_file PHP config option in uri | 85 |
| ET WEB_SPECIFIC_APPS PHP-CGI OS Command Injection (soft hyphen) (CVE-2024-4577) | 85 |
| ET WEB_SERVER /etc/shadow Detected in URI | 84 |
| ET SCAN NMAP SIP Version Detection Script Activity | 82 |
| ET WEB_SERVER Generic PHP Remote File Include | 79 |
| ET WEB_SERVER PHP.//Input in HTTP POST | 79 |
| ET EXPLOIT Apache log4j RCE Attempt - lower/upper TCP Bypass M2 (CVE-2021-44228) | 76 |
| ET EXPLOIT Apache log4j RCE Attempt (http ldap) (CVE-2021-44228) | 76 |
| ET EXPLOIT Apache log4j RCE Attempt (tcp ldap) (CVE-2021-44228) | 76 |
| ET HUNTING Suspicious PHP Code in HTTP POST (Inbound) | 72 |
| SURICATA DNS Invalid opcode | 72 |
| ET WEB_SERVER Possible SQL Injection (exec) in HTTP Request Body | 72 |
| ET SCAN NMAP SIP Version Detect OPTIONS Scan | 71 |
| SERVER-WEBAPP PHP PHP-CGI command execution attempt | 71 |
| ET INFO Abused Hosting Domain in DNS Lookup (azurewebsites .net) | 68 |
| ET EXPLOIT F5 BIG-IP iControl REST Authentication Bypass Attempt (CVE-2022-1388) M3 | 65 |
| ET INFO F5 BIG-IP - Command Execution via util/bash | 65 |
| ET MALWARE MS Remote Desktop micros User Login Request | 64 |
| ET INFO POSSIBLE Web Crawl using Curl | 63 |
| ET USER_AGENTS Suspcious LeakIX User-Agent (l9explore) | 63 |
| ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack | 62 |
| SURICATA TLS handshake invalid length | 57 |
| SURICATA HTTP URI terminated by non-compliant character | 53 |
| ET INFO SOCKSv4 HTTP Proxy Inbound Request (Linux Source) | 53 |
| ET WEB_SERVER .bash_history Detected in URI | 53 |
| ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan | 52 |
| ET WEB_SERVER Inbound PHP User-Agent | 52 |
| SURICATA HTTP request header invalid | 51 |
| ET DOS Potential CLDAP Amplification Reflection | 50 |
| ET MALWARE MS Remote Desktop edc User Login Request | 48 |
| ET INFO Infrastructure as a Service Domain in DNS Lookup (railway .app) | 46 |
| ET SCAN Amap UDP Service Scan Detected | 45 |
| ET WEB_SERVER Possible DD-WRT Metacharacter Injection Command Execution Attempt | 44 |
| ET VOIP REGISTER Message Flood UDP | 43 |
| ET WEB_SPECIFIC_APPS Totolink A3700R Multiple Authentication Bypass cstecgecgi.cgi Endpoints (CVE-2025-3663 - CVE-2025-3668) | 42 |
| ET SCAN Yandex Webcrawler User-Agent (YandexBot) | 41 |
| ET INFO DNS Query for Suspicious .icu Domain | 40 |
| ET INFO Inbound Frequent Emails - Possible Spambot Inbound | 40 |
| SURICATA HTTP missing Host header | 39 |
| SURICATA SMTP invalid pipelined sequence | 37 |
| ET WEB_SERVER Tilde in URI - potential .php~ source disclosure vulnerability | 36 |
| SURICATA HTTP Host part of URI is invalid | 35 |
| ET SCAN RDP Connection Attempt from Nmap | 35 |
| ET INFO PHP Xdebug Extension Query Parameter (XDEBUG_SESSION_START) | 33 |
| ET EXPLOIT Possible Vacron NVR Remote Command Execution | 32 |
| ET SCAN Suspicious User-Agent Containing Web Scan/er Likely Web Scanner | 31 |
| SURICATA HTTP status 100-Continue already seen | 30 |
| ET Threatview.io High Confidence Cobalt Strike C2 IP group 17 | 30 |
| MALWARE-BACKDOOR Aspx.Webshell.Agent inbound request for known webshell path attempt | 30 |
| ET INFO URL Shortening Service Domain in DNS Lookup (shorturl .at) | 28 |
| SERVER-OTHER Apache Log4j logging remote code execution attempt | 27 |
| ET HUNTING XML External Entity Injection Inbound M1 | 26 |
| ET WEB_SERVER Possible XXE SYSTEM ENTITY in POST BODY. | 26 |
| SURICATA STREAM 3way handshake wrong seq wrong ack | 25 |
| ET WEB_SERVER SQL Injection Select Sleep Time Delay | 25 |
| ET INFO WinHttpRequest Downloading EXE | 24 |
| ET SCAN External Host Probing for ChromeCast Devices | 24 |
| ET SCAN DuckDuckGo Webcrawler User-Agent (DuckDuckBot) | 23 |
| PROTOCOL-DNS Malformed DNS query with HTTP content | 23 |
| ET INFO Java Url Lib User Agent Web Crawl (Inbound) | 22 |
| ET WEB_SERVER JBoss jmx-console Probe | 22 |
| ET WEB_SERVER PHP System Command in HTTP POST | 22 |
| ET WEB_SPECIFIC_APPS Possible JBoss JMX Console Beanshell Deployer WAR Upload and Deployment Exploit Attempt | 22 |
| ET Threatview.io High Confidence Cobalt Strike C2 IP group 3 | 21 |
| SURICATA DNS Z flag set | 20 |
| ET INFO Inbound /uploadify.php Access | 20 |
| ET SCAN FTPSync Settings Disclosure Attempt | 20 |
| SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt | 20 |
| INDICATOR-SCAN DNS version.bind string information disclosure attempt | 19 |
| ET EXPLOIT Apache HTTP Server SSRF (CVE-2021-40438) | 18 |
| ET EXPLOIT Microsoft Exchange Pre-Auth Path Confusion M1 (CVE-2021-31207) | 18 |
| SERVER-WEBAPP JBoss JMX console access attempt | 18 |
| SURICATA HTTP Host header ambiguous | 18 |
| ET WEB_SERVER ColdFusion componentutils access | 18 |
| SERVER-WEBAPP Pulse Secure SSL VPN version check attempt | 18 |
| POLICY-OTHER Adobe ColdFusion component browser access attempt | 18 |
| SQL 1 = 1 - possible sql injection attempt | 17 |
| ET WEB_SPECIFIC_APPS WordPress Plugin - Essential Addons for Elementor - Password Reset Attempt (CVE-2023-32243) | 17 |
| SURICATA HTTP2 too long frame data | 15 |
| ET WEB_SERVER Possible SQL Injection UNION SELECT in HTTP Request Body | 14 |
| SURICATA TLS invalid heartbeat encountered, possible exploit attempt (heartbleed) | 13 |
| ET Threatview.io High Confidence Cobalt Strike C2 IP group 19 | 13 |
| OS-OTHER Bash CGI environment variable injection attempt | 13 |
| ET EXPLOIT Possible Zimbra Autodiscover Servlet XXE (CVE-2019-9670) | 12 |
| ET EXPLOIT Zimbra <8.8.11 - XML External Entity Injection/SSRF Attempt (CVE-2019-9621) | 12 |
| ET WEB_SERVER Possible CVE-2014-6271 Attempt in Headers | 12 |
| ET WEB_SPECIFIC_APPS TOTOLINK N600R cstecgi.cgi langType parameter Command Injection Attempt (CVE-2022-26189, CVE-2025-9935) | 12 |
| ET EXPLOIT Apache HTTP Server - Path Traversal Attempt (CVE-2021-42013) M1 | 11 |
| ET SCAN Behavioral Unusual Port 135 traffic Potential Scan or Infection | 11 |
| ET Threatview.io High Confidence Cobalt Strike C2 IP group 11 | 11 |
| SERVER-WEBAPP Facade Ignition remote code execution attempt | 10 |
| ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) | 10 |
| ET INFO Referrer-Policy set to unsafe-url | 10 |
| SERVER-APACHE Apache HTTP server SSRF attempt | 10 |
| SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt | 10 |
| ET HUNTING Possible Apache log4j RCE Attempt - Any Protocol TCP (CVE-2021-44228) | 9 |
| ET INFO SOCKSv4 HTTP Proxy Inbound Request (Windows Source) | 9 |
| SURICATA ICMPv4 unknown version | 9 |
| ET WEB_SERVER Possible IIS Integer Overflow DoS (CVE-2015-1635) | 9 |
| SURICATA UDP packet too small | 9 |
| ET HUNTING Suspicious Netlify Hosted DNS Request - Possible Phishing Landing | 8 |
| ET INFO DNS Query for Suspicious .ml Domain | 8 |
| SURICATA ICMPv4 unknown code | 8 |
| ET WEB_SERVER CURL Command Specifying Output in HTTP Headers | 8 |
| ET WEB_SPECIFIC_APPS XML External Entity Information Disclosure | 8 |
| ET WEB_SERVER Fake Googlebot UA 2 Inbound | 7 |
| SURICATA TLS invalid SSLv2 header | 6 |
| ET EXPLOIT Hikvision IP Camera RCE Attempt (CVE-2021-36260) | 6 |
| ET HUNTING .exec in HTTP URI Inbound - Possible Exploit Activity | 6 |
| ET HUNTING IPFS Gateway Domain in DNS Lookup (ipfs .dweb .link) | 6 |
| ET HUNTING SUSPICIOUS SMTP EXE - ZIP file with .exe filename inside (Inbound) | 6 |
| ET INFO DNS Query for Suspicious .ga Domain | 6 |
| ET SCAN Google Webcrawler User-Agent (Mediapartners-Google) | 6 |
| SURICATA HTTP gzip decompression failed | 6 |
| ET WEB_SERVER Exploit Suspected PHP Injection Attack (cmd=) | 6 |
| ET WEB_SERVER ThinkPHP RCE Exploitation Attempt | 6 |
| ET WEB_SPECIFIC_APPS Wordpress LiteSpeed Cache Plugin debug.log Access Attempt (CVE-2024-44000) | 6 |
| ET DOS Possible NTP DDoS Inbound Frequent Un-Authed PEER_LIST_SUM Requests IMPL 0x03 | 5 |
| ET EXPLOIT Likely Struts S2-053-CVE-2017-12611 Exploit Attempt M2 | 5 |
| SERVER-OTHER Sentinel license manager buffer overflow attempt | 5 |
| ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M2 | 5 |
Back to top