Last updated Sat, 30 May 2026 20:05:00 (Australia/Brisbane)
Below is a list of the top 500 IP addresses with suspicious activity observed by SCARD. Click on an IP address below for more information about its activity.
Note: Due to the overwhelming number of common scan types, this list omits typical scan types in favour of less-seen threat types.
Back to top
Below is a list of the top 200 threat types observed across the network.
| Description | Incidence |
|---|---|
| ET INFO Session Traversal Utilities for NAT (STUN Binding Response) | 17495 |
| ET SCAN LeakIX Inbound User-Agent | 13584 |
| ET SCAN WordPress Scanner Performing Multiple Requests to Windows Live Writer XML | 11611 |
| ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182) | 9890 |
| ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body | 9246 |
| ET EXPLOIT Apache HTTP Server - Path Traversal Attempt (CVE-2021-42013) M2 | 7406 |
| ET WEB_SERVER WebShell Generic - wget http - POST | 7106 |
| ET HUNTING Suspicious Chmod Usage in URI (Inbound) | 7009 |
| ET WEB_SERVER WEB-PHP phpinfo access | 6831 |
| ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response | 5592 |
| ET INFO External Oracle T3 Requests Inbound | 5037 |
| ET HUNTING Javascript Sandbox Escape via Global Object (process) | 4959 |
| ET INFO Netlink GPON Login Attempt (GET) | 4698 |
| ET HUNTING Request for Webshell in .well-known directory | 4298 |
| ET INFO SSH-2.0-Go version string Observed in Network Traffic | 3581 |
| SURICATA TCP header length too small | 3395 |
| ET SCAN Rapid POP3S Connections - Possible Brute Force Attack | 3334 |
| ET EXPLOIT Possible Authenticated Command Injection Inbound - Comtrend VR-3033 (CVE-2020-10173) | 3221 |
| SURICATA HTTP Host header invalid | 3163 |
| ET SCAN Behavioral Unusually fast Terminal Server Traffic Potential Scan or Infection (Inbound) | 3108 |
| ET INFO Python aiohttp User-Agent Observed Inbound | 3082 |
| ET EXPLOIT D-Link DSL-2750B - OS Command Injection | 3003 |
| ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) | 3003 |
| SURICATA TCP invalid option length | 2988 |
| SERVER-WEBAPP D-Link DSL-2750B routers login.cgi command injection attempt | 2707 |
| ET INFO Request for Visual Studio Code sftp.json - Possible Information Leak | 2581 |
| ET SCAN Mirai Variant User-Agent (Inbound) | 2527 |
| SURICATA IKE invalid proposal | 2388 |
| ET INFO Apache Solr System Information Request | 2195 |
| ET SCAN SFTP/FTP Password Exposure via sftp-config.json | 2179 |
| SURICATA HTTP URI terminated by non-compliant character | 2135 |
| ET SCAN Nmap Scripting Engine User-Agent Detected (Nmap Scripting Engine) | 1906 |
| ET WEB_SERVER WGET Command Specifying Output in HTTP Headers | 1876 |
| ET EXPLOIT D-Link Devices Home Network Administration Protocol Command Execution | 1872 |
| ET EXPLOIT HackingTrio UA (Hello, World) | 1865 |
| ET VOIP INVITE Message Flood UDP | 1808 |
| SERVER-WEBAPP TP-Link Archer Router command injection attempt | 1781 |
| ET EXPLOIT MVPower DVR Shell UCE | 1755 |
| ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) | 1721 |
| SERVER-WEBAPP React Server Components remote code execution attempt | 1660 |
| SURICATA Applayer Unexpected protocol | 1659 |
| SURICATA Applayer No TLS after STARTTLS | 1659 |
| ET WEB_SERVER PHP tags in HTTP POST | 1657 |
| ET EXPLOIT Netgear DGN Remote Command Execution | 1653 |
| ET SCAN Laravel Debug Mode Information Disclosure Probe Inbound | 1614 |
| ET EXPLOIT GraphQL Introspection Query Attempt | 1611 |
| ET SCAN JAWS Webserver Unauthenticated Shell Command Execution | 1575 |
| ET INFO Spring Boot Actuator Health Check Request | 1550 |
| SERVER-OTHER tcpdump ISAKMP parser buffer overflow attempt | 1525 |
| SURICATA FRAG IPv4 Fragmentation overlap | 1458 |
| SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt | 1401 |
| ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan | 1379 |
| ET INFO Google DNS Over HTTPS Certificate Inbound | 1353 |
| SURICATA HTTP METHOD terminated by non-compliant character | 1300 |
| SURICATA HTTP request field missing colon | 1289 |
| SERVER-WEBAPP PHPUnit PHP remote code execution attempt | 1275 |
| ET DNS Query to a *.top domain - Likely Hostile | 1272 |
| ET VOIP Modified Sipvicious Asterisk PBX User-Agent | 1087 |
| ET EXPLOIT Realtek SDK - Command Execution/Backdoor Access Inbound (CVE-2021-35394) | 1086 |
| ET WEB_SERVER /etc/passwd Detected in URI | 1043 |
| ET INFO Observed DNS Query to .nexus TLD | 1014 |
| ET WEB_SERVER Wordpress Login Bruteforcing Detected | 1007 |
| SURICATA SMB malformed request dialects | 924 |
| ET SCAN Potential SSH Scan OUTBOUND | 914 |
| SURICATA HTTP invalid request field folding | 899 |
| ET INFO Observed DNS Query to .fit TLD | 770 |
| ET VOIP Possible Inbound VOIP Scan/Misuse With User-Agent Zoiper | 716 |
| SURICATA SMTP duplicate fields | 699 |
| SURICATA QUIC error on data | 672 |
| ET SCAN NETWORK Incoming Masscan detected | 640 |
| ET SCAN NMAP OS Detection Probe | 613 |
| ET SCAN Behavioral Unusual Port 1433 traffic Potential Scan or Infection | 528 |
| SURICATA ICMPv4 invalid checksum | 523 |
| ET INFO Infrastructure as a Service Domain in DNS Lookup (railway .app) | 510 |
| ET INFO ChatGPT-User Traffic Detected Inbound M1 | 493 |
| ET INFO ChatGPT-User Traffic Detected Inbound M2 | 493 |
| SURICATA DHCP truncated options | 488 |
| ET WEB_SERVER Possible SQL Injection (exec) in HTTP Request Body | 470 |
| ET SCAN Web Scanner - Fuzz Faster U Fool (Inbound) | 468 |
| ET WEB_SPECIFIC_APPS Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Default Credentials | 426 |
| ET WEB_SERVER auto_prepend_file PHP config option in uri | 422 |
| ET INFO Observed DNS Query to .cfd TLD | 418 |
| ET WEB_SERVER allow_url_include PHP config option in uri | 412 |
| ET WEB_SPECIFIC_APPS PHP-CGI OS Command Injection (soft hyphen) (CVE-2024-4577) | 402 |
| ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack | 401 |
| ET WEB_SERVER Generic PHP Remote File Include | 400 |
| ET WEB_SERVER PHP.//Input in HTTP POST | 400 |
| ET EXPLOIT Zyxel ZyWALL/USG OS Command Injection (CVE-2023-28771) | 394 |
| ET HUNTING Suspicious PHP Code in HTTP POST (Inbound) | 379 |
| SERVER-WEBAPP PHP PHP-CGI command execution attempt | 369 |
| ET Threatview.io High Confidence Cobalt Strike C2 IP group 3 | 358 |
| ET HUNTING Observed Query to .beauty TLD | 356 |
| ET WEB_SERVER .bash_history Detected in URI | 323 |
| ET SCAN NMAP SIP Version Detection Script Activity | 314 |
| ET SCAN RDP Connection Attempt from Nmap | 297 |
| ET WEB_SPECIFIC_APPS WordPress Plugin Gravity SMTP Unauthenticated REST API (CVE-2026-4020) | 292 |
| ET SCAN Exabot Webcrawler User Agent | 292 |
| ET EXPLOIT Apache log4j RCE Attempt - lower/upper TCP Bypass M2 (CVE-2021-44228) | 276 |
| ET EXPLOIT Apache log4j RCE Attempt (tcp ldap) (CVE-2021-44228) | 276 |
| ET WEB_SPECIFIC_APPS Vite Arbitrary File Read Via raw parameter (CVE-2025-30208) | 274 |
| ET EXPLOIT Apache log4j RCE Attempt (http ldap) (CVE-2021-44228) | 272 |
| ET HUNTING Suspicious PHP Code in HTTP POST (Outbound) | 271 |
| SURICATA TCP option invalid length | 269 |
| ET WEB_SERVER Tilde in URI - potential .php~ source disclosure vulnerability | 250 |
| ET WEB_SERVER Fake Googlebot UA 2 Inbound | 248 |
| SURICATA DNS Invalid opcode | 220 |
| ET USER_AGENTS WinRM User Agent Detected - Possible Lateral Movement | 209 |
| ET SCAN Yandex Webcrawler User-Agent (YandexBot) | 204 |
| ET EXPLOIT D-Link HNAP SOAPAction Command Injection (CVE-2015-2051, CVE-2019-10891, CVE-2022,37056, CVE-2024-33112, CVE-2025-114 | 202 |
| ET WEB_SERVER Possible D-Link Router HNAP Protocol Security Bypass Attempt | 202 |
| SERVER-WEBAPP D-Link multiple products HNAP SOAPAction header command injection attempt | 188 |
| SURICATA STREAM ESTABLISHED packet out of window | 184 |
| ET SCAN NMAP SIP Version Detect OPTIONS Scan | 179 |
| ET DOS Potential CLDAP Amplification Reflection | 177 |
| ET WEB_SERVER Inbound PHP User-Agent | 160 |
| ET INFO POSSIBLE Web Crawl using Curl | 160 |
| SURICATA HTTP request header invalid | 153 |
| SURICATA SMTP invalid pipelined sequence | 152 |
| ET WEB_SERVER Possible DD-WRT Metacharacter Injection Command Execution Attempt | 142 |
| SERVER-WEBAPP Vite Vitejs arbitrary file read attempt | 136 |
| ET WEB_SERVER Likely Malicious Request for /proc/self/environ | 136 |
| ET INFO Inbound Frequent Emails - Possible Spambot Inbound | 133 |
| SURICATA HTTP request buffer too long | 130 |
| ET DNS Query to a *.pw domain - Likely Hostile | 125 |
| SERVER-OTHER Apache Log4j logging remote code execution attempt | 115 |
| SURICATA DNS Z flag set | 112 |
| ET EXPLOIT F5 BIG-IP iControl REST Authentication Bypass Attempt (CVE-2022-1388) M3 | 109 |
| ET INFO F5 BIG-IP - Command Execution via util/bash | 109 |
| ET USER_AGENTS Suspcious LeakIX User-Agent (l9explore) | 108 |
| MALWARE-BACKDOOR Aspx.Webshell.Agent inbound request for known webshell path attempt | 106 |
| ET INFO PHP Xdebug Extension Query Parameter (XDEBUG_SESSION_START) | 106 |
| ET VOIP REGISTER Message Flood UDP | 103 |
| SURICATA STREAM 3way handshake SYN/ACK ignored TFO data | 102 |
| ET INFO Anonymous Domain Registrar CnC Domain in DNS Lookup (*. njalla .net) | 100 |
| ET INFO SOCKSv4 HTTP Proxy Inbound Request (Linux Source) | 100 |
| ET SCAN Amap UDP Service Scan Detected | 99 |
| ET MALWARE MS Remote Desktop micros User Login Request | 96 |
| SURICATA HTTP status 100-Continue already seen | 96 |
| ET EXPLOIT Possible Vacron NVR Remote Command Execution | 93 |
| ET WEB_SERVER SQL Injection Select Sleep Time Delay | 89 |
| ET SCAN DuckDuckGo Webcrawler User-Agent (DuckDuckBot) | 88 |
| ET WEB_SERVER /etc/shadow Detected in URI | 86 |
| SURICATA HTTP Host part of URI is invalid | 85 |
| ET SCAN External Host Probing for ChromeCast Devices | 84 |
| ET INFO Peach C++ Library User Agent Inbound | 77 |
| ET WEB_SERVER Next.js Middleware Authorization Bypass (CVE-2025-29927) | 76 |
| SURICATA TLS handshake invalid length | 75 |
| ET Threatview.io High Confidence Cobalt Strike C2 IP group 19 | 72 |
| ET INFO DNS Query for Suspicious .icu Domain | 72 |
| SURICATA UDP packet too small | 72 |
| PROTOCOL-DNS Malformed DNS query with HTTP content | 70 |
| SERVER-APACHE Apache Struts remote code execution attempt | 68 |
| ET INFO Abused Hosting Domain in DNS Lookup (azurewebsites .net) | 68 |
| ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M3 | 68 |
| ET WEB_SERVER Possible XXE SYSTEM ENTITY in POST BODY. | 67 |
| ET HUNTING XML External Entity Injection Inbound M1 | 67 |
| SURICATA SMTP invalid reply | 67 |
| SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt | 64 |
| ET INFO Java Url Lib User Agent Web Crawl (Inbound) | 64 |
| ET WEB_SERVER Possible SQL Injection UNION SELECT in HTTP Request Body | 60 |
| SURICATA TLS invalid record version | 59 |
| SQL HTTP URI blind injection attempt | 58 |
| ET WEB_SERVER ThinkPHP RCE Exploitation Attempt | 57 |
| SURICATA HTTP Host header ambiguous | 56 |
| SURICATA HTTP gzip decompression failed | 54 |
| ET EXPLOIT Cisco IOS XE Web Server Possible Authentication Bypass Attempt (CVE-2023-20198) (Inbound) | 52 |
| ET WEB_SERVER ColdFusion componentutils access | 50 |
| ET INFO Observed DNS Query to .work TLD | 50 |
| POLICY-OTHER Adobe ColdFusion component browser access attempt | 50 |
| ET SCAN Suspicious User-Agent Containing Web Scan/er Likely Web Scanner | 49 |
| SERVER-WEBAPP Pulse Secure SSL VPN version check attempt | 48 |
| ET INFO DNS Query for Suspicious .ga Domain | 48 |
| ET MALWARE MS Remote Desktop edc User Login Request | 48 |
| ET WEB_SERVER HTTP POST Generic eval of base64_decode | 46 |
| ET WEB_SERVER PHP System Command in HTTP POST | 45 |
| SURICATA SMTP tls rejected | 45 |
| SURICATA TLS invalid heartbeat encountered, possible exploit attempt (heartbleed) | 44 |
| ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) | 43 |
| ET EXPLOIT Linksys E-Series Device RCE Attempt | 43 |
| ET WEB_SPECIFIC_APPS Linksys E-Series OS Command Injection (CVE-2025-34037) M1 | 43 |
| ET WORM TheMoon.linksys.router 2 | 43 |
| ET EXPLOIT Apache Obfuscated log4j RCE Attempt (tcp ldap) (CVE-2021-44228) | 42 |
| ET WEB_SPECIFIC_APPS Shenzhen TVT NVMS-9000 Information Disclosure Attempt (CVE-2024-14007) | 42 |
| ET WEB_SPECIFIC_APPS Tenda AdvSetMacMtuWan wanMTU Parameter Buffer Overflow Attempt (CVE-2025-10432) | 42 |
| SURICATA HTTP missing Host header | 42 |
| ET WEB_SPECIFIC_APPS Totolink A3700R Multiple Authentication Bypass cstecgecgi.cgi Endpoints (CVE-2025-3663 - CVE-2025-3668) | 42 |
| ET INFO Referrer-Policy set to unsafe-url | 42 |
| ET SCAN Behavioral Unusual Port 135 traffic Potential Scan or Infection | 41 |
| SERVER-WEBAPP Next.js Middleware authentication bypass attempt | 40 |
| ET EXPLOIT Possible Zimbra Autodiscover Servlet XXE (CVE-2019-9670) | 39 |
| ET EXPLOIT Zimbra <8.8.11 - XML External Entity Injection/SSRF Attempt (CVE-2019-9621) | 39 |
| ET HUNTING Possible Apache log4j RCE Attempt - Any Protocol TCP (CVE-2021-44228) | 39 |
| ET EXPLOIT Fortigate VPN - Request to /remote/info - Possible CVE-2023-27997 Exploit Attempt | 38 |
| INDICATOR-SCAN DNS version.bind string information disclosure attempt | 38 |
| ET DNS DNS Lookup for localhost.DOMAIN.TLD | 37 |
| SERVER-WEBAPP Zyxel unauthenticated IKEv2 overflow attempt | 37 |
| ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) | 37 |
| ET Threatview.io High Confidence Cobalt Strike C2 IP group 11 | 37 |
| ET INFO Ask Webcrawler User-Agent | 37 |
| SERVER-WEBAPP Zyxel unauthenticated IKEv2 command injection attempt | 37 |
Back to top