Suspicious activity of an IP
- Last Updated: May 1, 2026
- 1 minute read
- Flowmon Products
- Flowmon Anomaly Detection System
- Documentation
This basic example demonstrates how to investigate a suspicious host.
Let's investigate communication with blacklisted hosts in the Dashboard. Untoggle all and select BLACKLIST.
The system identifies IP address 192.168.3.225 as the source of this communication. This represents an IoC (Indicator of Compromise). To see further details about this IP address, apply it as a filter to the graph.
The filtered results show that this IP address has been involved in scanning, dictionary attacks, and anomalies as a source. These activities indicate the host was likely compromised.
