The IP attempted a Rootkit installation to gain root access and control server activity.

Multiple requests from different IP addresses in a short span of time, suggesting a distributed brute force attack.

This IP belongs to Lockheed Martin.

The malicious IP was involved in a vishing attack, using the VoIP server to deceive users into revealing sensitive information.

This IP belongs to Optus.

Repeated pings or probe requests to the server, indicating a potential reconnaissance effort before the attack.

Multiple requests with the same X-Csrf-Token header.

This IP belongs to Twenty-First Century Fox.

The IP attempted to perform Integer Overflow attacks on the Apache server.

GET /server-status: Often an attempt to check Apache server status.

It tried to use the email server for bounce spam, of sending out spam to third parties with forged return paths.

It launched SQL injection attempts, to break our server database through poorly secured entry fields.

It attempted to perform a brute force attack on the IMAP server.

This IP was seen scanning for open ports and vulnerabilities, a common reconnaissance activity before launching attacks.

It attempted to use the FTP server to relay data to other systems.

This IP belongs to T-Mobile.

Automated Bot Traffic: Logs are showing an unusual large amount of traffic from known or suspected bot IPs.

This IP belongs to Boeing.

Repeated HTTP requests with error codes, indicating failed attempts to access restricted areas.

The IP was detected attempting to skirt our system's detection through spoofing.

The malicious IP was involved in a SQL Injection attack, attempting to manipulate a database for unauthorized access or data theft.

It attempted to use the Asterisk server as a relay for calls to premium-rate numbers.

The IP attempted to register as an Asterisk user with no password.

It attempted to use the SASL server to relay spam.

It attempted to perform a RIPv1 amplification attack on the SSH server.