Initiated a Zero-day attack, exploiting unknown vulnerabilities in our Mail and Postfix services.

The IP attempted to perform Directory Traversal attacks on the Apache server.

Suspicious URL Encoding: Seeing HTTP requests with a lot of %, suggesting URL encoding to evade detection.

This particular IP attempted to exploit vulnerabilities in our web applications.

The suspicious IP attempted to introduce spyware under the guise of software updates.

implemented multiple decryption attacks to gain unauthorized access to encrypted email data.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

The IP attempted to send malware-infected attachments from the Mail server.

The IP address was flagged for employing a packet sniffer on our network.

HEAD /: May be part of a larger Reconnaissance.

It attempted to send emails from the Postfix server that violate the server's usage policy.

This IP belongs to Anthem.

Various incidents of unwanted installation of malicious gaming apps were traced back to this IP.

This IP exhibited malicious sophistication by employing multi-vector attacks.

It partook in whaling attacks, specifically targeting high-profile users within our system.

This IP belongs to Procter & Gamble.

The deceptive IP was sneaking in spyware through clickjacking attacks to manipulate our users.

Multiple login attempts using different usernames, suggesting an attacker is trying to guess the correct username/password combination.

The reported IP was identified as a BadBot, engaging in harmful activities such as unauthorized web scraping and data mining.

The IP was actively seeking unpatched SSH software in hope of finding exploitable vulnerabilities.

It attempted to perform HTTP Response Splitting attacks on the Apache server.

The malicious IP was seen trying to perform a Replay attack, capturing SIP authentication data and resending it to gain unauthorized access.

The IP attempted to perform Remote File Inclusion (RFI) attacks on the Apache server.

This IP belongs to Ziggo.

The malicious IP engaged in distributed denial of service (DDoS) attacks, exhausting server resources and disrupting SSH services.