Signs of CSRF Attacks: Logs demonstrating HTTP GET requests with sensitive actions that should ideally require POST requests.

The IP attempted to use the FTP server to distribute zero-day exploit tools.

It attempted to perform a credential stuffing attack on the SSH server.

This IP belongs to State Farm Insurance.

GET /errors.log: Shows an actor trying to access server error logs.

This IP belongs to Shaw Communications.

This IP belongs to IBM.

It partook in whaling attacks, specifically targeting high-profile users within our system.

Distributed session hijackers from the IP were designed to capture and exploit web browser sessions.

It attempted to send phishing emails from the Postfix server.

This IP belongs to Goldman Sachs Group.

The malicious IP tried to brute force its way into the SASL authentication process.

This IP belongs to China Mobile.

It was found that the IP had deployed rogue security software in our system.

This IP belongs to United Technologies.

The IP was seen trying to upload files to the FTP server, possibly with the intent of distributing malware.

It attempted to move emails to different folders on the IMAP server without authorization.

GET /login.action: Trying to find a Struts2 application to exploit.

The IP attempted to use the Mail server to relay malware-infected attachments to other servers.

The IP sought to exploit the SSH-1 CRC32 vulnerability for expansive unauthorized access.

Multiple requests with the same Proxy-Authorization header.

Salom

It launched SQL injection attempts, to break our server database through poorly secured entry fields.

It attempted to perform XML Entity Expansion attacks on the Apache server.

This IP belongs to WordPress.com.