It attempted to use the FTP server to distribute password recovery tools.

This IP belongs to Archer-Daniels-Midland.

POST /xmlrpc.php: Could indicate an attempt at exploiting the WordPress xmlrpc.php file, often used for brute forcing.

This IP belongs to General Motors.

This IP belongs to Dell Technologies.

Repeated attempts to access directories or files that do not exist or are typically not accessed.

It made various efforts to insert spyware to monitor SSH communications covertly.

Attempts to use automated scripts or tools for password cracking.

Multiple requests with the same If-Range header.

It attempted to use the FTP server to distribute encryption tools.

The IP address attempted to stealthily spread screen scrapers, programs that take screenshots of the user's display.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

The IP made numerous attempts at SMTP Relay abuse by trying to send emails not meant for or from local users.

Multiple requests with the same Expect header.

The IP was linked to numerous attacks using web shells through web servers.

This malicious IP was reported for trying to perform a Man-in-the-Middle attack, intercepting and potentially altering communication between the FTP server and its clients.

This IP belongs to Pfizer.

Multiple requests with the same Range header.

The IP launched timing attacks, trying to understand our server timings for potential future exploits.

It attempted to login to the Postfix server with an invalid password.

It attempted to perform a man-in-the-middle attack on the IMAP server.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

GET /backup.sql: Attempting to access a backup of your database.

It was found that the IP had deployed rogue security software in our system.

The IP attempted to perform a key exchange attack on the SSH server.