This IP attempted to disrupt our systems through the propagation of worms.

This IP belongs to WordPress.com.

It utilized a Directory Harvest Attack, attempting to find valid e-mail addresses through guesswork.

It carried out TCP Hijacking, attempting to disrupt existing connections to SSH.

This IP was found responsible for a session hijacking attempt on our network.

This IP is linked to the distribution of commercial keyloggers designed to capture users' keystrokes.

This IP was caught circulating email worms, camouflaged as legitimate mails.

The IP attempted various header manipulation attacks, aiming to bypass spam filters.

The IP actively participated in snowshoe spamming, spreading its spam output across many IPs and domains to avoid detection.

GET /trace.axd: An attempt to find a debug handler in ASP.NET.

It made multiple requests with the same Range header.

GET /modules/productpageadverts/uploadimage.php: This is related to a known vulnerability in the Prestashop module productpageadverts.

It started header injection or email injection attempts, by adding extra data into the headers and confusing the server processes.

The IP attempted to use the Mail server to relay malware-infected attachments to other servers.

SQL Injection in HTTP Requests: Logs record HTTP requests that contain SQL statements. Possible strings could include 'SELECT *' or 'DROP TABLE', indicative of a SQL injection attack.

It attempted to upload malicious files to the SSH server.

It executed directory traversal attempts to access unauthorized directories / folders in our server.

The IP attempted to use the FTP server as a proxy for other malicious activities.

This malicious IP was reported for attempting a man-in-the-middle attack on the VoIP server, intercepting and potentially altering communication.

This IP belongs to BT Central Plus.

The IP attempted to perform Stack Overflow attacks on the Apache server.

It attempted to use the SSH server as a proxy for other malicious activities.

Unusual patterns in referrer URLs.

The IP was involved in a SIPVicious attack, a specific type of VoIP attack that scans for open SIP servers and then attempts to crack their passwords.

The IP made multiple requests with identical Accept-Encoding headers.