GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

This IP belongs to Abbott Laboratories.

It attempted to perform Command Injection attacks on the Apache server.

This IP belongs to Cigna.

This IP belongs to Zayo Bandwidth.

Multiple requests from user agents claiming to be bots (e.g., Googlebot) that do not match known bot IP ranges.

It attempted to use the FTP server to distribute identity theft tools.

This IP belongs to Costco Wholesale.

It attempted to login to the SSH server with an invalid password.

This IP was reported for attempting to register a large number of SIP extensions in a short time, a sign of a potential brute force attack.

This IP belongs to Bank of America.

The IP attempted to use the FTP server as a proxy for other malicious activities.

Repeated requests for the same file or page, indicating an attempt to crack a password or exploit a vulnerability.

The IP attempted to perform Integer Overflow attacks on the Apache server.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

It attempted to use the FTP server to distribute password cracking tools.

This IP was reported for attempting to use the SIP server to mask its true location and identity, a common tactic in VoIP phishing attacks.

This IP belongs to Archer-Daniels-Midland.

This IP belongs to NetEase.

The IP attempted to send emails from the IMAP server without authorization.

This IP belongs to Sony Network Communications.

This particular IP displayed behaviour typical of a ransomware-infected system, encrypting several files.

Multiple requests with the same If-Match header.

The IP maliciously used packet sniffers in attempts to decode SSH traffic.

It was making constant NDR (Non-Deliverable Receipt) or backscatter attacks by generating large amount of invalid email addresses.