The malicious IP was involved in a Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

This IP belongs to SingTel.

Unusual patterns of behavior, such as login attempts at regular intervals or sequential patterns in the attempted passwords.

This IP belongs to Globe Telecom.

The IP made multiple requests with the same TE header.

The IP engaged in a mail relay attack, using our server to send spam.

It launched SQL injection attempts, to break our server database through poorly secured entry fields.

POST /j_security_check: May indicate an attempt to bypass Java server page (JSP) login mechanisms.

Reverse Tabnabbing Attempts: Logs illustrating target="_blank" in URL, which is a sign of reverse tabnabbing attempt.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

It exploited CVE-specific server vulnerabilities as a backdoor entrance to our mail system.

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: request for a file often associated with an outdated version of Composer and phpunit used in a remote code execution attack.

This IP made wrongful manipulations indicating the operation of malicious downgrader.

This IP belongs to Walmart.

This IP was reported for attempting a Teardrop attack, sending mangled IP fragments with overlapping and oversized payloads to crash the target network device.

We linked several cryptojacking attempts, aimed at harnessing our system resources, to this IP.

The IP attempted to perform a distributed denial of service attack on the SSH server.

The IP sent malicious links via IM softwares, aiming to spread instant messaging worms.

POST /ckupload.php,: A threat actor attempting to exploit CKEditor’s file uploader.

This IP belongs to the University of California, Berkeley.

The IP was discovered trying Server Message Block relay attacks to gain unauthorized SSH access.

The IP sought to exploit the SSH-1 CRC32 vulnerability for expansive unauthorized access.

This IP belongs to Procter & Gamble.

udden increase in account lockouts due to multiple failed login attempts.

It attempted to take advantage of misconfigurations in the Apache server.