It attempted to use the SASL server to relay spam.

This IP belongs to Mondelez International.

It attempted to use the Postfix server to relay emails with misleading headers to other servers.

It attempted to use the FTP server to store illegal content.

This IP belongs to Comcast.

The IP engaged in an HTTP Desync attack, misaligning HTTP request and responses to yield SSH vulnerability.

It made successive tries to alter SMTP relay configurations to send unsolicited emails.

The malicious IP was involved in a credential stuffing attack, using stolen username-password combinations to gain unauthorized access.

This IP belongs to World Fuel Services.

It made multiple requests with the same If-None-Match header.

GET /admin: Looking for an unprotected admin page.

It attempted to perform HTTP Response Splitting attacks on the Apache server.

This IP belongs to Telefonica Spain.

This IP belongs to British Telecommunications.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

The IP attempted to implement a 'BlueKeep' exploit, leveraging protocol vulnerabilities to execute remote code through SSH network services.

The IP was involved in a SIP brute force attack, attempting to guess SIP authentication credentials to gain unauthorized access.

This IP belongs to FedEx.

The IP attempted to use the FTP server to distribute child pornography.

This IP belongs to Rogers Cable.

The IP was involved in a VoIP Hopping attack, jumping from one VoIP network to another to avoid detection or gain unauthorized access.

the IP made attempts at wiretapping the network to monitor SSH traffic patterns and gather useful information.

It launched invasive malware to corrupt crucial segments of our server functionality.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

It made multiple requests with the same X-Wap-Profile header.