This IP belongs to AT&T.

It tried to exploit Apache Struts vulnerabilities to compromise our web applications.

Server Misconfiguration Exploitation: Logs illustrating attempts at exploiting known server misconfigurations.

The IP attempted to use the SASL server to relay phishing emails.

This IP belongs to Pinterest.

The IP attempted code injection attacks, injecting malicious codes in HTTP headers.

This IP belongs to Walgreens Boots Alliance.

The IP attempted to perform a password spraying attack on the SSH server.

Distributed session hijackers from the IP were designed to capture and exploit web browser sessions.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

This IP belongs to PepsiCo.

Repeated attempts to perform actions that are typically restricted, such as creating or modifying user accounts.

The IP attempted to use the FTP server to distribute data recovery tools.

The IP attempted to perform a man-in-the-middle attack on the SASL server.

The IP was seen performing a CSRF (Cross-site request forgery) attack to manipulate user actions.

Probing for Hidden Files: HTTP requests for files that should not be publicly accessible could suggest an attacker probing for unsecured content.

POST /xmlrpc.php: Could indicate an attempt at exploiting the WordPress xmlrpc.php file, often used for brute forcing.

We discovered attempts from the IP to install rootkit spyware to gain control over our systems.

The malicious IP was reported for attempting to reroute calls through the SIP server, a tactic often used to commit toll fraud.

This IP belongs to Marathon Petroleum.

The IP was seen trying to perform a PASV FTP Bounce attack, misusing the passive mode to scan other hosts and ports.

Path/File Enumeration: Logs show multiple HTTP requests to non-existing pages and incrementing filenames, suggesting file or path enumeration.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

The IP attempted to mark emails as read on the POP3 server without authorization.

Executed email spoofing attempts pretending to be a trusted party.