It attempted to send emails from the Mail server that violate the server's email content policy.

HTTP Request with Large Content-Length: This could potentially indicate a buffer overflow attack where an attacker tries to crash the system by sending more data than it can handle.

This IP belongs to Nationwide.

This IP was caught circulating email worms, camouflaged as legitimate mails.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

It attempted to list the contents of directories that it should not have access to.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

This IP belongs to Telstra.

It tried to execute Privilege Escalation attacks, trying to gain higher-level access on our server.

The IP attempted to perform ARP Spoofing attacks on the Apache server.

This IP belongs to BT Central Plus.

The IP was seen trying to exploit known vulnerabilities in server software, a common tactic for gaining unauthorized access or control.

It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

The IP has been tagged as a source for data mining spyware, aiming to gather personal information.

It attempted to perform Heap Overflow attacks on the Apache server.

GET /db/finance.dump: An attempt to access a database dump file.

The IP attempted to download sensitive files from the SSH server.

The IP attempted to exploit known vulnerabilities in the VOIP protocol.

The IP made numerous attempts at SMTP Relay abuse by trying to send emails not meant for or from local users.

This IP belongs to Apple.

The IP attempted to perform Directory Traversal attacks on the Apache server.

This IP belongs to Pinterest.

This IP belongs to IBM.

The IP was recorded making persistent attempts to crack our encryption.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.