It attempted to perform Local File Inclusion (LFI) attacks on the Apache server.

Unusual increase in network bandwidth usage.

Multiple login attempts using common or easily guessable passwords (like 'password123', 'admin', etc.).

The IP attempted to use the SASL server to relay phishing emails.

Repeated attempts to exploit known vulnerabilities in the server operating system or applications.

It was noticed that the IP has tried illegal attempts of reverse engineering our software.

This IP belongs to TELUS Communications.

It attempted to perform a Smurf attack on the SSH server.

This IP was caught circulating email worms, camouflaged as legitimate mails.

The IP attempted to perform SOAP Injection attacks on the Apache server.

The IP tried to exploit remote file inclusion vulnerabilities, aiming to run malicious scripts on the server.

It attempted to exploit known vulnerabilities in the SSH protocol.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

The IP was reported for spamming activities, sending unsolicited emails or messages that often contain phishing links or malware.

This IP was distributing rogue security software, misleading users to think their systems are infected.

This IP belongs to Costco Wholesale.

Unwanted Web Crawler Activity: Observing unusual frequent requests from a known web crawler not granted to scan your site.

This IP belongs to Allstate.

It tried to create buffer overflows by sending large amounts of data at once to overwhelm server resources.

This IP belongs to Sony Network Communications.

Bursts of login attempts followed by periods of inactivity, suggesting an attacker is trying to avoid detection.

This IP was caught conducting cookie-poisoning attack.

The IP attempted to perform Cross-Site Scripting (XSS) attacks through the Apache server.

This IP belongs to MetLife.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.