The IP distributed unrequested software, secretly stealing user data while posing as useful tools.

This IP belongs to Cloudfare.

This IP belongs to Walmart.

HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: request for a file often associated with an outdated version of Composer and phpunit used in a remote code execution attack.

It attempted to perform a replay attack on the SASL server.

This malicious IP was reported for attempting a Zero-day exploit, exploiting a software vulnerability before it's known or fixed by the vendor.

GET /login.action: Trying to find a Struts2 application to exploit.

It tried to create buffer overflows by sending large amounts of data at once to overwhelm server resources.

This particular IP tried to perform an unauthorized system configuration change.

It's observed that the IP operated a series of attacks exploiting insecure direct object references.

The IP sought to exploit the SSH-1 CRC32 vulnerability for expansive unauthorized access.

It launched invasive malware to corrupt crucial segments of our server functionality.

Remote File Inclusion (RFI): You might see HTTP requests with "=http" or "=ftp" which can signal an attempt for remote file inclusion.

The IP address attempted to login to the Mail server with an invalid username.

It was involved in a Distributed Denial of Service (DDoS) attack.

This IP belongs to Alphabet.

It attempted to perform a SIP Brute Force attack on the SIP, VOIP, or Asterisk server.

The IP attempted to exploit known vulnerabilities in the SIP protocol.

This IP belongs to CHS.

It attempted to use the FTP server to distribute SQL injection tools.

Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

It systematically tried to exploit IMAP and POP3 vulnerabilities present in our mail service setup.

Executed email spoofing attempts pretending to be a trusted party.

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.