This object reports the IP address of the specific host that was targeted by a detected DDoS attack, drawn from the device's list of protected addresses it's actively monitoring for such attacks. Administrators use this to immediately identify which server or service on their network is under attack when this notification fires. For example, this field might read the address of a public-facing web server, such as 203.0.113.20, telling the admin exactly which protected system is currently being targeted.