GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.

The IP attempted to exploit known vulnerabilities in the Asterisk protocol.

It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

The IP attempted to use the FTP server as a proxy for other malicious activities.

The IP was involved in a DDoS attack, sending massive amounts of traffic to overwhelm a server and disrupt its normal functioning.

This IP belongs to Amazon.

The IP performed Covert Timing Channel attacks, gathering information about encrypted SSH traffic by analyzing packet timing.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

This IP was seen trying to perform a SIP Torture attack, sending malformed SIP messages to crash or degrade the performance of the server.

The IP address attempted to login to the Mail server with an invalid username.

Login attempts that do not follow typical user behavior patterns.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

The IP was seen trying to perform a TDoS (Telephony Denial of Service) attack, flooding the VoIP server with calls to make it unavailable to users.

The IP attempted to use the FTP server to distribute keylogging software.

This IP belongs to General Electric.

It attempted to use the FTP server to distribute zombie network tools.

The IP was involved in an Email Spoofing attack, sending emails with a forged sender address, often used in phishing and spam campaigns.

It made multiple requests from user agents claiming to be bots.

It attempted to login to the Mail server with an invalid password.

The IP attempted to perform a DNS amplification attack on the SSH server.

It attempted to use the FTP server to distribute traffic monitoring tools.

It launched a privilege escalation attack aiming to gain unauthorized access with higher-level permissions.

This IP was reported for attempting a Dictionary attack on the VoIP server, systematically entering every word in a dictionary as a password to find the correct one.

This IP belongs to Johnson & Johnson.