POST /upload.php: An attempt to upload a possibly malicious file.

The IP launched exploitation attacks based on the infamous 'Heartbleed' OpenSSL cryptographic vulnerabilities.

The malicious IP was spotted attempting to brute-force the SSH login credentials.

Our team has linked several viruses dissemination activities to this IP.

The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

The IP was seen trying to perform a FTP Reflection attack, using the FTP server to amplify its DDoS attack traffic.

Attempts to use privileged service accounts outside of their normal usage patterns.

The IP attempted to send emails from the IMAP server without authorization.

The IP attempted to perform a credential stuffing attack on the IMAP server.

This IP belongs to SingTel.

The IP was marked trying to carry out Backscatter spam by replying to spam using the server's configuration.

We observed the IP distributing harmful document tracking tools.

This IP belongs to Home Depot.

The IP made multiple requests with the same Via header.

Multiple requests with the same X-Requested-With header.

The IP attempted to perform a Bonk attack on the SSH server.

Our data revealed this IP distributing malicious powershell scripts.

It attempted to login to the SASL server with an invalid password.

Repeated attempts to use the same password across multiple accounts.

This IP belongs to Plusnet.

SQL Injection in HTTP Requests: Logs record HTTP requests that contain SQL statements. Possible strings could include 'SELECT *' or 'DROP TABLE', indicative of a SQL injection attack.

The IP attempted to send emails from the Postfix server to blacklisted email addresses.

This IP belongs to Tyson Foods.

landline