It tried to force its way into a secure admin session by trying to hijack the session's cookies.

It was observed attempting to conduct a replay attack, resending captured SSH packets in hopes of session hijacking.

Rudimentary attempts were made by this IP to execute Man-in-the-Browser attacks.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

This IP belongs to World Fuel Services.

System logs trace back the distribution of trojans that could allow for remote access to this suspicious IP.

The IP attempted to manipulate trusted authorities by conducting SSL strip attacks.

It appears that this IP was initiating DNSChanger malware attacks on our network.

It was making constant NDR (Non-Deliverable Receipt) or backscatter attacks by generating large amount of invalid email addresses.

The IP made multiple requests with the same Origin header.

The IP was seen trying to change the configuration settings of the Asterisk server, potentially to disable security features.

The IP attempted to perform XML External Entity (XXE) attacks on the Apache server.

The IP attempted to flood the Apache server with requests, in a Denial of Service (DoS) attack.

The IP was involved in a Directory Traversal attack on the FTP server, attempting to access restricted directories and files.

The IP attempted to create new directories on the FTP server.

The IP was reported for attempting a DNS Amplification attack, exploiting vulnerabilities in domain name servers to turn initially small queries into much larger payloads.

It launched header-based exploits, attempting to manipulate HTTP headers to cause inappropriate server responses.

The IP attempted to send emails from the Mail server to blacklisted email addresses.

The IP attempted to perform XML External Entity (XXE) attacks on the Apache server.

This malicious IP was reported for attempting a Smurf attack, flooding a target system via spoofed broadcast ping messages.

Unusual patterns in referrer URLs.

The IP address made multiple attempts to exploit a Remote File Inclusion (RFI) vulnerability.

Multiple failed login attempts from the same IP address.

It attempted to perform XML Entity Expansion attacks on the Apache server.

The IP targeted our server with PHP Injection attacks to gain access to sensitive data.