Last updated Sat, 28 Mar 2026 19:05:35 (Australia/Brisbane)
Below is a list of the top 1000 IP addresses with suspicious activity observed by SCARD. Click on an IP address below for more information about its activity.
Back to top
Below is a list of the top 200 threat types observed across the network.
| Description | Incidence |
|---|---|
| ET SCAN Suspicious inbound to MSSQL port 1433 | 12628468 |
| ET SCAN Suspicious inbound to PostgreSQL port 5432 | 3999272 |
| ET SCAN Suspicious inbound to mySQL port 3306 | 3156123 |
| ET SCAN Suspicious inbound to Oracle SQL port 1521 | 2931698 |
| ET INFO Go-http-client User-Agent Observed Inbound | 383869 |
| ET SCAN HID VertX and Edge door controllers discover | 321382 |
| SURICATA TCP invalid option length | 309989 |
| SERVER-OTHER RealTek UDPServer command injection attempt | 303126 |
| ET EXPLOIT Realtek eCos RSDK/MSDK Stack-based Buffer Overflow Attempt Inbound (CVE-2022-27255) | 291048 |
| SURICATA UDPv4 invalid checksum | 272138 |
| ET INFO SSH-2.0-Go version string Observed in Network Traffic | 264027 |
| ET SCAN Potential VNC Scan 5800-5820 | 240314 |
| ET INFO Request to Hidden Environment File - Inbound | 193386 |
| ET EXPLOIT Zyxel ZyWALL/USG OS Command Injection (CVE-2023-28771) | 185032 |
| ET SCAN Sipvicious User-Agent Detected (friendly-scanner) | 167304 |
| ET DOS Possible SSDP Amplification Scan in Progress | 113553 |
| ET DOS DNS Amplification Attack Inbound | 108736 |
| SURICATA TCP header length too small | 103588 |
| ET SCAN Zmap User-Agent (Inbound) | 98630 |
| SURICATA TCPv4 invalid checksum | 90903 |
| ET INFO User-Agent (python-requests) Inbound to Webserver | 71871 |
| SURICATA HTTP Host header invalid | 54598 |
| ET SCAN Sipvicious Scan | 52893 |
| ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt | 51745 |
| SERVER-WEBAPP Apache HTTP Server httpd directory traversal attempt | 43433 |
| ET WEB_SERVER WebShell Generic - wget http - POST | 40457 |
| ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2 | 37462 |
| ET SCAN WordPress Scanner Performing Multiple Requests to Windows Live Writer XML | 35691 |
| SURICATA IPv4 invalid checksum | 34273 |
| ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body | 33874 |
| ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182) | 31348 |
| ET SCAN Rapid IMAPS Connections - Possible Brute Force Attack | 27367 |
| ET EXPLOIT Realtek SDK - Command Execution/Backdoor Access Inbound (CVE-2021-35394) | 26303 |
| ET SCAN LeakIX Inbound User-Agent | 25191 |
| ET HUNTING Javascript Sandbox Escape via Global Object (process) | 25154 |
| ET WEB_SERVER WEB-PHP phpinfo access | 24341 |
| SERVER-WEBAPP TP-Link Archer Router command injection attempt | 23018 |
| ET HUNTING Generic IOT Downloader Malware in POST (Inbound) | 21437 |
| ET SCAN NMAP OS Detection Probe | 19466 |
| ET SCAN Behavioral Unusually fast Terminal Server Traffic Potential Scan or Infection (Inbound) | 18905 |
| SERVER-WEBAPP PHPUnit PHP remote code execution attempt | 18889 |
| ET SCAN Rapid POP3S Connections - Possible Brute Force Attack | 15828 |
| ET INFO External Oracle T3 Requests Inbound | 14724 |
| ET INFO Netlink GPON Login Attempt (GET) | 14689 |
| ET EXPLOIT Apache HTTP Server - Path Traversal Attempt (CVE-2021-42013) M2 | 13703 |
| ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response | 12129 |
| ET VOIP INVITE Message Flood UDP | 11767 |
| SURICATA TLS invalid SNI length | 11570 |
| ET SCAN Rapid IMAP Connections - Possible Brute Force Attack | 11455 |
| ET SCAN Mirai Variant User-Agent (Inbound) | 10583 |
| ET SCAN Rapid POP3 Connections - Possible Brute Force Attack | 10581 |
| ET INFO Python aiohttp User-Agent Observed Inbound | 10028 |
| ET INFO Apache Solr System Information Request | 9275 |
| ET WEB_SPECIFIC_APPS MVPower CCTV DVR /shell JAWS Webserver Unauthenticated Remote Command Execution (CVE-2016-20016) | 8603 |
| ET SCAN Laravel Debug Mode Information Disclosure Probe Inbound | 8203 |
| ET WEB_SERVER PHP tags in HTTP POST | 7700 |
| PROTOCOL-DNS DNS query amplification attempt | 7490 |
| SERVER-WEBAPP React Server Components remote code execution attempt | 7185 |
| ET SCAN SFTP/FTP Password Exposure via sftp-config.json | 7120 |
| ET INFO Request for Visual Studio Code sftp.json - Possible Information Leak | 6915 |
| SURICATA IKE invalid proposal | 6463 |
| ET EXPLOIT MVPower DVR Shell UCE | 6293 |
| SURICATA STREAM ESTABLISHED packet out of window | 6279 |
| ET EXPLOIT GraphQL Introspection Query Attempt | 6052 |
| SURICATA STREAM 3way handshake wrong seq wrong ack | 6040 |
| SURICATA Applayer No TLS after STARTTLS | 5884 |
| SURICATA Applayer Unexpected protocol | 5884 |
| ET SCAN Nmap Scripting Engine User-Agent Detected (Nmap Scripting Engine) | 5781 |
| ET SCAN JAWS Webserver Unauthenticated Shell Command Execution | 5666 |
| ET USER_AGENTS Suspcious LeakIX User-Agent (l9explore) | 5581 |
| ET EXPLOIT HackingTrio UA (Hello, World) | 5567 |
| ET INFO Http Client Body contains pwd= in cleartext | 5539 |
| ET WEB_SERVER WGET Command Specifying Output in HTTP Headers | 5497 |
| ET EXPLOIT Netgear DGN Remote Command Execution | 5151 |
| ET EXPLOIT D-Link Devices Home Network Administration Protocol Command Execution | 5148 |
| ET WEB_SERVER /etc/passwd Detected in URI | 5104 |
| ET HUNTING Suspicious Chmod Usage in URI (Inbound) | 4937 |
| ET USER_AGENTS WinRM User Agent Detected - Possible Lateral Movement | 4882 |
| ET DNS Query to a *.top domain - Likely Hostile | 4753 |
| SURICATA HTTP URI terminated by non-compliant character | 4350 |
| SERVER-WEBAPP Netgear DGN1000 series routers authentication bypass attempt | 4275 |
| SURICATA HTTP METHOD terminated by non-compliant character | 4112 |
| SURICATA UDP invalid length field in the header | 3888 |
| ET USER_AGENTS BLEXBot User-Agent | 3852 |
| ET VOIP Modified Sipvicious Asterisk PBX User-Agent | 3797 |
| SURICATA SMB malformed request dialects | 3742 |
| SURICATA FRAG IPv4 Fragmentation overlap | 3702 |
| SURICATA ICMPv4 invalid checksum | 3542 |
| SURICATA HTTP request field missing colon | 3477 |
| ET WEB_SERVER ThinkPHP RCE Exploitation Attempt | 3460 |
| ET WEB_SPECIFIC_APPS TBK DVR-4104/4216 Command Injection Attempt (CVE-2024-3721) | 3417 |
| ET INFO Observed DNS Query to .nexus TLD | 3107 |
| ET SCAN NETWORK Incoming Masscan detected | 2983 |
| SURICATA ICMPv4 unknown code | 2962 |
| ET MALWARE TINYSHELL irad Variant ICMP Inbound (uSarguuS62bKRA0J) | 2791 |
| ET WEB_SERVER Wordpress Login Bruteforcing Detected | 2790 |
| ET VOIP Possible Inbound VOIP Scan/Misuse With User-Agent Zoiper | 2786 |
| ET WEB_SERVER auto_prepend_file PHP config option in uri | 2531 |
| ET WEB_SERVER allow_url_include PHP config option in uri | 2531 |
| ET WEB_SERVER Possible SQL Injection (exec) in HTTP Request Body | 2496 |
| ET WEB_SERVER PHP System Command in HTTP POST | 2343 |
| SERVER-WEBAPP PHP PHP-CGI command execution attempt | 2281 |
| ET WEB_SERVER PHP.//Input in HTTP POST | 2255 |
| ET WEB_SERVER Generic PHP Remote File Include | 2203 |
| ET WEB_SPECIFIC_APPS PHP-CGI OS Command Injection (soft hyphen) (CVE-2024-4577) | 2197 |
| ET INFO Ninja/NinjaOne RMM Domain in DNS Lookup (ninjarmm .com) | 2181 |
| ET DOS Possible NTP DDoS Inbound Frequent Un-Authed MON_LIST Requests IMPL 0x02 | 2152 |
| ET SCAN Potential SSH Scan OUTBOUND | 2151 |
| ET INFO Abused Hosting Domain in DNS Lookup (azurewebsites .net) | 2100 |
| ET HUNTING Suspicious PHP Code in HTTP POST (Inbound) | 2051 |
| ET SCAN NMAP SIP Version Detection Script Activity | 2020 |
| SURICATA HTTP invalid request field folding | 1956 |
| ET SCAN Sipsak SIP scan | 1931 |
| ET SCAN Behavioral Unusual Port 1433 traffic Potential Scan or Infection | 1839 |
| ET HUNTING Request for Webshell in .well-known directory | 1736 |
| ET INFO Observed UDP cups-browsed Add Printer Packet Inbound (IPP) | 1723 |
| ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan | 1714 |
| SURICATA SMTP duplicate fields | 1448 |
| ET INFO Spring Boot Actuator Health Check Request | 1431 |
| ET SCAN Yandex Webcrawler User-Agent (YandexBot) | 1419 |
| ET INFO Observed DNS Query to .cfd TLD | 1337 |
| ET DNS Query to a *.pw domain - Likely Hostile | 1288 |
| ET WEB_SPECIFIC_APPS Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway - Default Credentials | 1247 |
| ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack | 1209 |
| ET INFO Java Url Lib User Agent Web Crawl (Inbound) | 1189 |
| SERVER-OTHER Apache Log4j logging remote code execution attempt | 1069 |
| ET SCAN DuckDuckGo Webcrawler User-Agent (DuckDuckBot) | 1066 |
| ET SCAN MS Terminal Server Traffic on Non-standard Port | 1048 |
| ET WEB_SERVER Tilde in URI - potential .php~ source disclosure vulnerability | 915 |
| SURICATA ICMPv6 invalid checksum | 886 |
| MALWARE-OTHER Php.Webshell.C0ders inbound connection attempt | 879 |
| ET DOS Potential CLDAP Amplification Reflection | 864 |
| ET HUNTING Suspicious PHP Code in HTTP POST (Outbound) | 863 |
| SURICATA GRE v0 flags | 853 |
| SURICATA SMTP invalid pipelined sequence | 846 |
| PROTOCOL-DNS Malformed DNS query with HTTP content | 834 |
| ET WEB_SPECIFIC_APPS Shenzhen TVT NVMS-9000 Information Disclosure Attempt (CVE-2024-14007) | 809 |
| ET SCAN NMAP SIP Version Detect OPTIONS Scan | 807 |
| ET SCAN Internal Dummy Connection User-Agent Inbound | 798 |
| OS-OTHER Bash CGI environment variable injection attempt | 764 |
| ET INFO Inbound Frequent Emails - Possible Spambot Inbound | 723 |
| SERVER-ORACLE Oracle WebLogic Server remote command execution attempt | 721 |
| SURICATA DNS Invalid opcode | 671 |
| SURICATA HTTP status 100-Continue already seen | 642 |
| SURICATA UDP packet too small | 640 |
| ET WEB_SERVER Possible CVE-2014-6271 Attempt in Headers | 637 |
| ET EXPLOIT Mikrotik Winbox RCE Attempt (CVE-2018-14847) | 620 |
| ET EXPLOIT Apache log4j RCE Attempt - lower/upper TCP Bypass M2 (CVE-2021-44228) | 601 |
| ET EXPLOIT Multiple DLink Routers Remote Code Execution CVE-2019-16920 | 599 |
| SURICATA HTTP Unexpected Request body | 596 |
| SURICATA HTTP request header invalid | 574 |
| ET WEB_SPECIFIC_APPS Oracle WebLogic Deserialization (CVE-2018-2893) | 551 |
| ET INFO SOCKSv4 HTTP Proxy Inbound Request (Linux Source) | 546 |
| ET WEB_SERVER HTTP POST Generic eval of base64_decode | 545 |
| SURICATA HTTP request buffer too long | 541 |
| ET INFO Observed UDP cups-browsed Add Printer Packet Inbound (HTTP) | 535 |
| ET INFO PHP Xdebug Extension Query Parameter (XDEBUG_SESSION_START) | 522 |
| ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer M3 | 519 |
| ET EXPLOIT Possible CVE-2014-6271 Attempt Against SIP Proxy | 513 |
| ET EXPLOIT Apache log4j RCE Attempt (tcp ldap) (CVE-2021-44228) | 510 |
| ET EXPLOIT Apache log4j RCE Attempt (http ldap) (CVE-2021-44228) | 510 |
| ET WEB_SERVER Possible XXE SYSTEM ENTITY in POST BODY. | 491 |
| ET INFO Observed ZeroSSL SSL/TLS Certificate | 488 |
| ET EXPLOIT LB-Link Command Injection Attempt (CVE-2023-26801) | 439 |
| ET WEB_SERVER Inbound PHP User-Agent | 432 |
| ET HUNTING HTTP URI Path Normalization Bypasses & Escapes M1 | 412 |
| SURICATA DNS Z flag set | 388 |
| SERVER-WEBAPP Zyxel unauthenticated IKEv2 overflow attempt | 380 |
| SERVER-WEBAPP Zyxel unauthenticated IKEv2 command injection attempt | 380 |
| ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP Cookie | 371 |
| ET INFO POSSIBLE Web Crawl using Curl | 371 |
| ET WEB_SPECIFIC_APPS Vite Arbitrary File Read Via raw parameter (CVE-2025-30208) | 368 |
| MALWARE-BACKDOOR Aspx.Webshell.Agent inbound request for known webshell path attempt | 359 |
| ET EXPLOIT Possible Zimbra Autodiscover Servlet XXE (CVE-2019-9670) | 346 |
| ET EXPLOIT Zimbra <8.8.11 - XML External Entity Injection/SSRF Attempt (CVE-2019-9621) | 345 |
| ET WEB_SPECIFIC_APPS Four-Faith adjust_sys_time adj_time Command Injection Attempt (CVE-2024-12856) | 345 |
| ET SCAN Suspicious User-Agent Containing Web Scan/er Likely Web Scanner | 339 |
| ET INFO External IP Lookup Domain (db-ip .com) in DNS Lookup | 333 |
| ET WEB_SERVER Script tag in URI Possible Cross Site Scripting Attempt | 329 |
| ET WEB_SERVER disable_functions PHP config option in uri | 319 |
| ET EXPLOIT Suspected Exim External Auth Overflow (CVE-2023-42115) | 311 |
| ET INFO DNS Query to Cloudflare Tunneling Domain (argotunnel .com) | 307 |
| ET WEB_SPECIFIC_APPS Oracle WebLogic Server OS Command Injection Attempt Inbound (CVE-2017-3506) | 291 |
| ET EXPLOIT Oracle WebLogic - wls-wsat Component Deserialization Remote Code Execution Unix | 290 |
| ET HUNTING SUSPICIOUS SMTP EXE - RAR file with .exe filename inside | 289 |
| ET MALWARE MS Remote Desktop micros User Login Request | 282 |
| ET SCAN RDP Connection Attempt from Nmap | 279 |
| SURICATA STREAM 3way handshake SYN resend different seq on SYN recv | 279 |
| ET WEB_SERVER Possible DD-WRT Metacharacter Injection Command Execution Attempt | 268 |
| ET WEB_SPECIFIC_APPS Spring Framework FileSystemResource Path Traversal (CVE-2024-38816) | 267 |
| PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt | 264 |
| ET WEB_SERVER ColdFusion componentutils access | 263 |
| ET WEB_SERVER Cisco IOS HTTP Server Exec Command Execution Attempt | 262 |
| ET HUNTING XML External Entity Injection Inbound M1 | 259 |
| ET DNS DNS Lookup for localhost.DOMAIN.TLD | 257 |
| SURICATA QUIC error on data | 250 |
| ET WEB_SPECIFIC_APPS Joomla Improper Access Control to Webservice Endpoints (CVE-2023-23752) | 240 |
| SERVER-WEBAPP Atlassian Confluence OGNL injection remote code execution attempt | 239 |
| ET WEB_SERVER Possible D-Link Router HNAP Protocol Security Bypass Attempt | 234 |
| ET MALWARE BPFDoor ICMP Magic Packet (Inbound) M1 | 232 |
Back to top