The IP engaged in a mail relay attack, using our server to send spam.

The IP attempted to perform a DNS amplification attack on the SSH server.

This IP belongs to Lowe's.

It sent VOIP requests to non-existent extensions.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

It attempted to perform Heap Overflow attacks on the Apache server.

This IP belongs to American Express.

It attempted to use the SSH server as a proxy for other malicious activities.

It attempted to perform a VOIP Hopper scan on the Asterisk server.

This particular IP has been used in advanced persistent threats against our servers.

Server Side Request Forgery Attempts: Logs may show HTTP requests attempting to manipulate the server into making unintended requests.

It attempted to perform a VOIP Hopper scan on the Asterisk server.

Repeated attempts to access the server using encrypted or obfuscated data, which can indicate an attacker is trying to hide their activities.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

This IP belongs to Nationwide.

The IP tried to launch 'Dark Tequila' malware that steals banking information and login credentials from the server.

This IP belongs to Verizon Communications.

This IP belongs to Pinterest.

This IP belongs to Berkshire Hathaway.

It was found actively trying to exploit HTTP Response Splitting vulnerabilities to perform further attacks.

This IP was seen scanning for open ports and vulnerabilities, a common reconnaissance activity before launching attacks.

The IP attempted to use the SSH server to relay data to other systems.

The IP sent numerous VOIP OPTIONS requests in a short time.

It was detected trying to perform cross-site scripting to bypass the same origin policy on Apache.

This IP belongs to Telstra.