Multiple attempts to access the server using anonymous or generic user accounts.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

The IP was seen engaging in a Slowloris attack, holding as many connections to the target web server open for as long as possible, eventually overloading the server.

This IP belongs to Medium.

The malicious IP was reported for attempting to manipulate file permissions on the FTP server, potentially to gain unauthorized access or expose sensitive data.

It repeatedly attempted to run server-side injection attacks, trying to execute malicious code on our server.

This IP belongs to Nike.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.

This malicious IP was reported for attempting to perform a Replay attack, capturing FTP authentication data and resending it to gain unauthorized access.

It sought to exploit cross-site scripting (XSS) vulnerabilities within our mail service web interface.

POST /modules/raptor_file_manager/upload.php: Attempt to use a known flaw in the Raptor file manager for arbitrary file upload.

The IP attempted to use the Mail server to relay phishing emails to other servers.

It started header injection or email injection attempts, by adding extra data into the headers and confusing the server processes.

The IP mounted HTTP Parameter Pollution attacks, disrupting server processes by injecting adulterated parameters.

It attempted to perform Cross-Site Request Forgery (CSRF) attacks through the Apache server.

This IP belongs to Best Buy.

This IP was seen trying to perform a RTP Injection attack, inserting audio into an established VoIP call.

Multiple failed attempts to use the server’s API.

Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

The IP tried to launch 'Dark Tequila' malware that steals banking information and login credentials from the server.

It exploited CVE-specific server vulnerabilities as a backdoor entrance to our mail system.

The IP attempted to perform a key exchange attack on the SSH server.

It initiated several reverse IP lookup requests, probing for server vulnerabilities.

This IP belongs to NTT Docomo.

It made multiple requests with the same Expect header.