Unidentified password attempts and login activity were noticed from the specific IP address.

This malicious IP was reported for trying to perform a Routed Attack, using the FTP server as a jump point to attack another system.

It actively sought to exploit unpatched software within our server applications.

This IP belongs to Valero Energy.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

It sought to exploit cross-site scripting (XSS) vulnerabilities within our mail service web interface.

This IP belongs to Costco Wholesale.

The IP attempted to send emails with misleading headers from the Mail server.

The IP launched HTTP tunnel attacks, attempting to wrap other protocols in HTTP to bypass network filters.

This IP belongs to DuPont de Nemours.

It established numerous 'doppelganger' domains to mimic our SSH server, aiming to trick users into revealing sensitive data.

Multiple login attempts using common or easily guessable passwords (like 'password123', 'admin', etc.).

It engaged in mail bombing, flooding the server with large amounts of insignificant mails.

Frequent access requests from user agents that are known to be associated with malicious tools or bots.

It attempted to perform a replay attack on the SASL server.

Server Side Template Injection: Suspicious input patterns aimed at coercing server-side parsers to execute injected code.

The IP sent numerous SIP OPTIONS requests in a short time.

A sudden surge in the number of requests per second, indicating an automated process.

It made numerous requests to the same endpoint in a short time.

The IP made multiple requests with identical Accept-Encoding headers.

The IP was involved in a Caller ID Spoofing attack, falsifying the caller ID to deceive the receiver or hide the caller's identity.

The IP attempted to bypass IP blacklisting by rapidly changing its IP address.

Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.

The IP engaged in an HTTP Desync attack, misaligning HTTP request and responses to yield SSH vulnerability.

The IP initiated fake traffic attacks to manipulate webpage rankings and conduct click fraud.