The IP attempted to perform XML Attribute Blowup attacks on the Apache server.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

The IP was noticed spreading RATs (remote administration tools) camouflaged as regular software.

The IP attempted to use the FTP server to distribute secure deletion tools.

The IP tried to perform a cross-site request forgery attack on the IMAP service.

Multiple requests with the same Expect header.

This IP belongs to Sony Network Communications.

It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

It established numerous 'doppelganger' domains to mimic our SSH server, aiming to trick users into revealing sensitive data.

Multiple requests with identical POST parameters.

The IP tried to manipulate DNS lookup processes to divert traffic to a malicious destination.

This IP belongs to Cloudfare.

This IP belongs to KDDI.

The IP attempted to use the FTP server to distribute data recovery tools.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

This IP belongs to Nintendo.

Multiple requests with the same Proxy-Authorization header.

This IP belongs to World Fuel Services.

We observed the IP distributing harmful document tracking tools.

This IP belongs to World Fuel Services.

It attempted to use the Postfix server to relay malware-infected attachments to other servers.

The malicious IP initiated unauthorized Mail Queue access attempts, impacting mail service efficiency.

It attempted to use the FTP server to distribute identity theft tools.

This IP belongs to The Hartford Financial Services.

The IP attempted to perform a SIP Invite Flood on the Asterisk server.