This IP injected exploit kit into our system, taking advantage of software vulnerabilities.

This IP was detected distributing spyware-infected USB drives to our users.

Multiple requests with the same Warning header.

This IP was detected uploading malicious codes in our network.

This IP belongs to Time Warner Cable Internet.

The IP attempted to use the FTP server to distribute VPN tools.

It attempted to perform a SIPVicious scan on the Asterisk server.

It initiated SSL-Stripping attacks, aiming to downgrade secure HTTPS connections to less-secure HTTP.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

This malicious IP was involved in a Clickjacking attack, tricking users into clicking on something different from what the user perceives, potentially leading to confidential information disclosure or takeover of their computer.

WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.

The IP attempted to perform a replay attack on the POP3 server.

Participated in a botnet attack to overwhelm our server’s resources.

This malicious IP was reported for attempting to execute a Cross-Site Request Forgery (CSRF) attack, tricking a victim into executing unwanted actions on the FTP server.

This IP belongs to Hostgator.

This IP was implicated in attempts to inject ransomware into our systems.

This IP was tracked while attempting to distribute secretive and malicious keyloggers.

It attempted to send emails from the Postfix server that violate the server's email content policy.

The IP attempted to perform a brute force attack on the SSH server.

Repeated attempts to access directories or files that do not exist or are typically not accessed.

Login Attempts on Non-Existent Users: Many login requests for non-existent usernames could suggest a blind username enumeration attack.

This IP belongs to PepsiCo.

It appeared to be taking part in SSL Stripping attacks, downgrading secure HTTPS connections to facilitate eavesdropping.

Repeated Unique 404 Errors: Logs revealing a steady stream of unique 404 errors could suggest a DDoS attack aiming to exhaust storage resources.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.