GET /configuration.php.old: Trying to locate backup configuration files.

This IP belongs to Telstra.

Repeated Unique 404 Errors: Logs revealing a steady stream of unique 404 errors could suggest a DDoS attack aiming to exhaust storage resources.

It attempted to perform HTTP Response Splitting attacks on the Apache server.

Automated Bot Traffic: Logs are showing an unusual large amount of traffic from known or suspected bot IPs.

It attempted to perform a SIP Brute Force attack on the SIP, VOIP, or Asterisk server.

It attempted to perform a SSDP amplification attack on the SSH server.

It attempted to exploit known vulnerabilities in the Mail protocol.

We observed the IP distributing harmful document tracking tools.

It attempted to perform a credential stuffing attack on the SASL server.

The IP engaged in an HTTP Desync attack, misaligning HTTP request and responses to yield SSH vulnerability.

The IP tried to perform a cross-site request forgery attack on the IMAP service.

GET /db/finance.dump: An attempt to access a database dump file.

The IP attempted to perform a timing attack on the SSH server.

Unexpected HTTP Methods Usage: Frequent HTTP TRACE method attempts could be an attempt to intercept network requests.

It attempted to perform a Teardrop attack on the SSH server.

Attempts to use privileged service accounts outside of their normal usage patterns.

This IP belongs to JPMorgan Chase.

This malicious IP was reported for attempting to execute a Cross-Site Request Forgery (CSRF) attack, tricking a victim into executing unwanted actions on the FTP server.

This IP was traced back to unusual network abnormalities evidencing Ghostware.

Repeated attempts to exploit known vulnerabilities in the server operating system or applications.

This IP belongs to JPMorgan Chase.

Repeated attempts to exploit known vulnerabilities in the server operating system or applications.

This IP belongs to Cardinal Health.

This IP belongs to Medium.