Attempts to use default or common usernames and passwords, a common tactic in brute force attacks.

It initiated 'HOIC' (High Orbit Ion Cannon) to overload our Apache service with junk data.

This IP has been flagged for attempting to escalate privileges in our network.

It attempted to use the FTP server to distribute botnet command and control software.

GET /ELMAH.axd: Attempting to exploit ELMAH (Error Logging Modules and Handlers) misconfiguration in ASP.NET sites.

It attempted command injection attacks, hoping to execute unauthorized commands.

The IP was reported for attempting a DNS Amplification attack, exploiting vulnerabilities in domain name servers to turn initially small queries into much larger payloads.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.

The IP was involved in a FTP Fuzzing attack, sending random or malformed data to the FTP server to cause a crash or reveal vulnerabilities.

This IP belongs to Sky Broadband.

This IP belongs to DuPont de Nemours.

This IP belongs to the University of California, Berkeley.

The IP made multiple requests with the same Proxy-Authorization header.

It attempted to use the FTP server to distribute terrorist propaganda.

It made multiple requests with the same X-Att-Deviceid header.

The IP sent numerous VOIP OPTIONS requests in a short time.

The IP attempted reconnaissance activities, trying to footprint our server’s network.

This IP belongs to TELUS Communications.

It exploited insecure server configurations and attempted to establish reverse SSH tunneling.

The IP launched timing attacks, trying to understand our server timings for potential future exploits.

The IP attempted to perform Session Hijacking attacks on the Apache server.

The IP made multiple requests with the same Warning header.

It attempted to perform a dictionary attack on the SASL server.

Finally, the IP was caught in the act of Abandoned Object attacks, creating objects with no reference to exhaust memory space

It sought to exploit cross-site scripting (XSS) vulnerabilities within our mail service web interface.