Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

The IP made multiple requests with the same If-Match header.

This IP was reported for attempting a Dictionary attack on the VoIP server, systematically entering every word in a dictionary as a password to find the correct one.

User-mode rootkits, originating from the particular IP, were causing system instability and crashes.

Made various attempts at a forged return-path attack, attempting to spoof their source email address.

The IP attempted to use the FTP server to distribute child pornography.

The malicious IP was found trying to exploit the IMAP 'unselect' vulnerability.

This IP belongs to Best Buy.

It attempted to login to the Postfix server with an invalid password.

Several cross-site scripting attacks were traced back to this IP.

It was discovered illicitly scanning the server for potential vulnerabilities.

The IP attempted to perform XML Attribute Blowup attacks on the Apache server.

Excessive Form Submission Attempts: Numerous form submission attempts within a short time, signifying brute-force or captcha bypass attempts.

This malicious IP was reported for trying to perform a FTP Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

It attempted to perform Insecure Direct Object References attacks on the Apache server.

Various incidents of unwanted installation of malicious gaming apps were traced back to this IP.

Bursts of login attempts followed by periods of inactivity, suggesting an attacker is trying to avoid detection.

This IP has been linked to numerous occurrences of spyware distribution within our networks.

It attempted to execute unauthorized commands on the Apache server.

FTP Over HTTP: Logs may show HTTP requests containing FTP commands, potentially indicating an FTP Injection attack.

Attempts to use automated scripts or tools for password cracking.

By leveraging the AgeTunnel software, the IP attempted to establish a covert channel across the SSH session.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

This IP belongs to Oracle.

The IP was linked to numerous attacks using web shells through web servers.