GET /manager/html: Signals an attempt to access the Tomcat Application Manager.

Multiple requests with the same Range header.

It established numerous 'doppelganger' domains to mimic our SSH server, aiming to trick users into revealing sensitive data.

It attempted to use the FTP server to distribute botnet command and control software.

This IP belongs to UnitedHealth Group.

The IP was detected attempting to skirt our system's detection through spoofing.

The IP attempted to use the FTP server to distribute forensics tools.

Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

This IP belongs to Citigroup.

The IP attempted to register with the VOIP server using an invalid username.

This IP belongs to Procter & Gamble.

POST /ckupload.php,: A threat actor attempting to exploit CKEditor’s file uploader.

The IP was caught distributing VoIP crackers to exploit our communication channels.

The IP attempted to perform a key exchange attack on the SSH server.

The IP was the origin of numerous webcam loggers, a serious privacy invasion.

The IP initiated IP spoofing, fooling our systems to trust its malicious communication.

The IP attempted to perform ARP Spoofing attacks on the Apache server.

Attempts to access the server using stolen or leaked credentials.

It repeatedly tried to inject malicious script code into the system via appending it to an email body.

This IP belongs to Canadian Department of Defense.

This IP injected exploit kit into our system, taking advantage of software vulnerabilities.

The IP attempted to perform a Multicast DNS amplification attack on the SSH server.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

It attempted to exploit known vulnerabilities in the Mail protocol.

This IP was caught distributing malicious APK files.