It was observed attempting to conduct a replay attack, resending captured SSH packets in hopes of session hijacking.

This IP belongs to 3M.

It made multiple requests with identical cookies.

We linked the IP to numerous attacks using RM adware, causing regular system interruptions.

This IP was seen trying to perform a SIP URI Spoofing attack, falsifying the SIP URI to deceive the receiver or hide the caller's identity.

The IP was seen trying to exploit known vulnerabilities in the Asterisk server, a common tactic for gaining unauthorized access or control.

Repeated failed attempts to perform actions that require higher privileges.

The IP has been distributing browser hijackers that alter the user's browsing experience without their consent.

The IP attempted to send malware-infected attachments from the Postfix server.

Smuggling Attack: Logs showing a single IP initiating multiple sessions, implying a Smuggling Attack.

This IP belongs to Lowe's.

Multiple requests with the same If-Range header.

The IP attempted to perform Symlink attacks on the Apache server.

Multiple login attempts using different usernames, suggesting an attacker is trying to guess the correct username/password combination.

GET /vuln.html: Looking for any page vulnerabilities.

It attempted to login to the Postfix server with an invalid password.

Unusual command line activities that are not typical for the server environment.

It initiated multiple account lockouts in a short period.

This IP belongs to Oracle.

It attempted to intercept SSL/TLS secured mail connections to eavesdrop or modify the passing data.

This IP belongs to Ubisoft.

This IP belongs to Valero Energy.

Multiple requests with the same Proxy-Authorization header.

It was flagged that this IP had been used in conducting method tampering on our servers.

It attempted to exploit known vulnerabilities in the Postfix software.