This malicious IP was reported for attempting to execute a Cross-Site Request Forgery (CSRF) attack, tricking a victim into executing unwanted actions on the FTP server.

The IP attempted to perform XML Attribute Blowup attacks on the Apache server.

This IP belongs to World Fuel Services.

The IP attempted to send emails from the Mail server pretending to be from a different sender.

This IP was caught distributing malicious APK files.

Unusual patterns in the Accept-Language header.

The malicious IP conducted HTTP verb tampering, exploiting varying responses to different HTTP methods.

GET /CFIDE/administrator/enter.cfm: An attempt to get into the ColdFusion admin console.

This IP belongs to Berkshire Hathaway.

Code Injection: Usage of standard codes (like Base64) to obscure attack payloads or commands.

The IP was part of an IRC-Bot network, a type of botnet that uses the Internet Relay Chat (IRC) protocol.

The IP was reported for spamming activities, sending unsolicited emails or messages that often contain phishing links or malware.

The IP attempted code injection attacks, injecting malicious codes in HTTP headers.

It carried out TCP Hijacking, attempting to disrupt existing connections to SSH.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

This IP belongs to TIAA.

It attempted to use the FTP server to distribute traffic monitoring tools.

The IP was seen trying to perform a Denial of Service (DoS) attack, attempting to make a machine or network resource unavailable to its intended users.

It attempted to use the VOIP server as a relay for calls to premium-rate numbers.

This IP belongs to Oracle.

GET /db/finance.dump: An attempt to access a database dump file.

It was discovered using our server in an open relay configuration, sending emails from unauthorized domains.

The IP attempted to mark emails as read on the IMAP server without authorization.

Login attempts from foreign IP addresses.

It attempted to use the FTP server to distribute phishing emails.