Participated in malicious pranks by altering messages sent through the server.

Initiated a Zero-day attack, exploiting unknown vulnerabilities in our Mail and Postfix services.

The IP was caught attempting to execute heap overflow attacks.

The IP attempted 'DLL Injection' to alter the server's behavior in a malicious manner.

This IP has been observed spreading mobile malware, targeting our company application users.

This IP belongs to World Fuel Services.

GET /errors.log: Shows an actor trying to access server error logs.

The IP initiated clickjacking exploits, causing users to unwittingly perform malicious actions during SSH sessions.

This IP belongs to Anthem.

This IP belongs to Marathon Petroleum.

Multiple requests with the same Origin header.

This IP belongs to Walmart.

It initiated 'HOIC' (High Orbit Ion Cannon) to overload our Apache service with junk data.

Code Injection: Usage of standard codes (like Base64) to obscure attack payloads or commands.

Executed numerous SQL injection attacks in an attempt to manipulate the server's databases.

It attempted to use the FTP server to distribute password cracking tools.

This malicious IP was reported for trying to intercept VoIP calls, a type of eavesdropping attack aimed at capturing sensitive information.

It attempted to delete directories on the FTP server.

This IP belongs to Deutsche Telekom AG.

It attempted to perform Session Sidejacking attacks on the Apache server.

Frequent access requests from user agents that are known to be associated with malicious tools or bots.

This IP belongs to Proximus.

This IP belongs to OVH.

Signs of CSRF Attacks: Logs demonstrating HTTP GET requests with sensitive actions that should ideally require POST requests.

It attempted to perform a dictionary attack on the SASL server.