It engaged in a click fraud operation using our server’s communication channels.

Multiple requests with the same X-Csrf-Token header.

It attempted to send emails from the Postfix server that violate the server's email content policy.

IP Spoofing: Logs showing HTTP requests with IP ranges that are typically reserved for private networks or an unusual X-Forwarded-For header.

It attempted to send emails with malicious links from the Postfix server.

It attempted to carry out a dictionary attack on pop3 logins to gain unauthorized access.

The IP launched exploitation attacks based on the infamous 'Heartbleed' OpenSSL cryptographic vulnerabilities.

Multiple failed attempts to use the server’s API.

The IP made multiple unsuccessful login attempts in a short period of time.

The malicious IP was spotted attempting to brute-force the SSH login credentials.

Remote Execution Attempts: Logs showing unusual terminal commands or scripts run through web access.

The IP attempted to use the FTP server to distribute hacking tutorials.

The IP was reported for spamming activities, sending unsolicited emails or messages that often contain phishing links or malware.

It was noticed that the IP has tried illegal attempts of reverse engineering our software.

Multiple requests with identical cookies.

This IP belongs to Cox Communications.

The malicious IP was reported for attempting a SIP Ping attack, sending SIP OPTIONS messages to discover SIP servers or users.

User-mode rootkits, originating from the particular IP, were causing system instability and crashes.

It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

The malicious IP was suspected of cryptojacking, illicitly using others' computing resources to mine cryptocurrencies.

It attempted to perform a man-in-the-middle attack on the IMAP server.

This IP belongs to General Electric.

The malicious IP attempted ARP spoofing to fool the server into sending information to the wrong destination.

The IP attempted to change file permissions on the SSH server.

The IP was involved in a FTP Flood attack, sending a large number of FTP connection requests to overwhelm the server.