It attempted to list the contents of directories that it should not have access to.

This IP belongs to PepsiCo.

This IP belongs to TJX.

Login attempts at unusual times (e.g., in the middle of the night).

GET /.env: Attempting to access a file that may contain sensitive environment variable data.

The IP attempted to use the FTP server to distribute credit card fraud tools.

Repeated pings or probe requests to the server, indicating a potential reconnaissance effort before the attack.

The IP attempted to send emails from the Mail server that violate the server's email sending limits.

It attempted to flood the Asterisk server with REGISTER requests.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

This IP belongs to Jabil.

It attempted to send emails with deceptive subject lines from the Postfix server.

This IP belongs to Valero Energy.

Attempts to login using a sequential list of passwords, indicating a possible brute force attack.

It executed blind command injection, exploiting server inputs to gain unauthorized system control.

The IP was involved in a Directory Traversal attack, attempting to access restricted directories and files.

Participated in a botnet attack to overwhelm our server’s resources.

This IP belongs to Globe Telecom.

Attempts to access the server using unusual HTTP methods or request types.

Excessive traffic from a single IP address.

The IP attempted to use the FTP server to distribute web vulnerability scanning tools.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

The IP was seen trying to exploit known vulnerabilities in server software, a common tactic for gaining unauthorized access or control.

It attempted to use the SASL server to distribute malware.

We traced a significant increase in the distribution of malicious fake security software to the reported IP.