It exploited CVE-specific server vulnerabilities as a backdoor entrance to our mail system.

It tried to execute Privilege Escalation attacks, trying to gain higher-level access on our server.

The IP has been caught trying to deliver spyware into our system to compromise sensitive data.

The IP was discovered trying Server Message Block relay attacks to gain unauthorized SSH access.

Unknown source code changes in our system were linked back to this offensive IP address.

The IP attempted to gain unauthorized access to the Apache server.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

This IP was seen trying to perform a SIP Torture attack, sending malformed SIP messages to crash or degrade the performance of the server.

This malicious IP was reported for trying to perform a Symlink attack, creating symbolic links to files outside the FTP server's root directory.

This IP belongs to McKesson.

The IP tried to exploit remote file inclusion vulnerabilities, aiming to run malicious scripts on the server.

The IP attempted to send emails from the IMAP server without authorization.

POST /login.jsp?user=admin&pass=admin: This could be an attempt to log in as an admin.

This IP belongs to Phillips 66.

This IP blocked legitimate users by performing IP hijacking.

This particular IP displayed behaviour typical of a ransomware-infected system, encrypting several files.

The malicious IP was reported for attempting to reroute calls through the SIP server, a tactic often used to commit toll fraud.

Excessive Form Submission Attempts: Numerous form submission attempts within a short time, signifying brute-force or captcha bypass attempts.

GET /index.php?param=: Attempting a cross-site scripting (XSS) attack.

It was involved in the operation of a REG-Bot, a type of bot that performs automated tasks.

This IP belongs to Exxon Mobil.

The IP launched Ping Flood attacks as a detrimental strategy to overwhelm server resources.

The IP attempted a pass-the-hash attack, trying to authenticate without knowing the plaintext password.

Repeated attempts to access directories or files that do not exist or are typically not accessed.