Attempts to access sensitive areas of the server, such as the admin page or user account information.

It attempted to use the FTP server to distribute password recovery tools.

The IP attempted to use the Mail server to relay emails with misleading headers to other servers.

Multiple attempts to access the server using encrypted tunnels or proxies.

Multiple requests with the same Range header.

Multiple attempts to access the server using credentials that were previously compromised in a data breach.

This IP belongs to IBM.

The IP attempted to perform a password spraying attack on the SASL server.

This malicious IP was reported for trying to perform a Man-in-the-Middle attack, intercepting and potentially altering communication between the FTP server and its clients.

POST /ckupload.php,: A threat actor attempting to exploit CKEditor’s file uploader.

The IP attempted to perform a credential stuffing attack on the IMAP server.

The IP engaged in an HTTP Desync attack, misaligning HTTP request and responses to yield SSH vulnerability.

It appears this IP was linked to a number of drive-by-download attacks, silently downloading spyware.

Path/File Enumeration: Logs show multiple HTTP requests to non-existing pages and incrementing filenames, suggesting file or path enumeration.

We flagged down attempts from the IP to leak backdoor viruses into the system.

The IP attempted to use the FTP server to distribute network mapping tools.

udden increase in account lockouts due to multiple failed login attempts.

The IP actively tried code replacement attacks, swapping legitimate system call addresses with malicious ones.

Our technical team unearthed the IP's involvement in distributing malicious mobile spyware.

The IP was involved in a Directory Traversal attack, attempting to access restricted directories and files.

Our system flagged the IP for injecting malicious script into benign pages through the man-in-the-browser attack.

Multiple requests with the same X-Requested-With header.

The IP attempted to perform a VOIP Hopper scan on the VOIP server.

This IP addressed employed a method of brute force attack attempting to compromise our systems.

TLS Downgrade Attacks: Logs showing repeated attempts to establish non-TLS connections with the server.