It tried to exploit Apache Struts vulnerabilities to compromise our web applications.

This IP belongs to TJX.

The IP actively participated in snowshoe spamming, spreading its spam output across many IPs and domains to avoid detection.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

This IP belongs to AT&T.

It tried to force its way into a secure admin session by trying to hijack the session's cookies.

The IP was involved in a RTP Bleeding attack, exploiting vulnerabilities in the VoIP server to listen to ongoing calls.

This IP belongs to Reliance Jio.

Unknown IP Address: An unfamiliar IP address making frequent requests could imply a compromised machine.

We linked several cryptojacking attempts, aimed at harnessing our system resources, to this IP.

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

Shell Injection: Logs show requests containing command line shell syntax, suggesting shell command injection.

The IP attempted to use the FTP server to distribute spam.

This malicious IP attempted a brute force attack, trying to crack login credentials to gain unauthorized access to a system or account.

It attempted to use the FTP server to relay data to other systems.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

Damaging activities showing connections to rootkit attacks were associated with this IP.

It sent Asterisk requests to non-existent extensions.

This malicious IP was reported for attempting a Zero-day exploit, exploiting a software vulnerability before it's known or fixed by the vendor.

The IP was involved in a FTP Injection attack, exploiting vulnerabilities in the FTP server to execute unauthorized commands.

This IP belongs to Target.

The IP attempted to perform a password spraying attack on the SSH server.

The IP was involved in a FTP Flood attack, sending a large number of FTP connection requests to overwhelm the server.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.