The IP attempted to perform a password spraying attack on the SSH server.

The IP was involved in a FTP Fuzzing attack, sending random or malformed data to the FTP server to cause a crash or reveal vulnerabilities.

Multiple requests to the server's robots.txt file.

The IP was seen trying to change the configuration settings of the Asterisk server, potentially to disable security features.

The IP tried to exploit buffer overflow vulnerabilities to run unauthorized code.

It attempted to perform XPath Injection attacks on the Apache server.

Directories Traversal Attempts: Logs showing HTTP requests that include ".." or "/.." might illustrate someone's effort to locate or exploit sensitive data.

It attempted to delete emails from the POP3 server without authorization.

System logs trace back the distribution of trojans that could allow for remote access to this suspicious IP.

Reverse Tabnabbing Attempts: Logs illustrating target="_blank" in URL, which is a sign of reverse tabnabbing attempt.

The IP attempted to send emails from the IMAP server without authorization.

Several cross-site scripting attacks were traced back to this IP.

The IP performed regular system foot printing to gain intel on weak points in our server.

Malicious Script Execution: Execution attempts of suspicious scripts or encoded payloads often seen in URI parameters or request bodies.

The IP attempted to perform Cross-Site Scripting (XSS) attacks through the Apache server.

The IP made multiple requests with the same X-UIDH header.

It attempted to send emails from the Mail server to a large number of recipients.

It made various efforts to insert spyware to monitor SSH communications covertly.

This IP belongs to Slack.

Unusual patterns in the sequence of requests.

The IP attempted to launch Ciphertext attacks, trying to decrypt SSH-encrypted communication.

Probing for Hidden Files: HTTP requests for files that should not be publicly accessible could suggest an attacker probing for unsecured content.

It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

It attempted to make unauthorized calls using the Asterisk server.

Our team flagged this IP for injecting harmful ActiveX codes.