GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

Unusual activity in the server's error logs.

GET /wp-config.php~: Requesting the backup files which may expose sensitive information.

The IP attempted to use the Mail server to relay malware-infected attachments to other servers.

The IP attempted to perform a replay attack on the IMAP server.

This IP belongs to Apple.

This IP belongs to The Walt Disney Company.

Unusual command line activities that are not typical for the server environment.

The IP mounted HTTP Parameter Pollution attacks, disrupting server processes by injecting adulterated parameters.

Tried to carry out a rainbow table attack, attempting to crack hashed passwords.

It actively sought to exploit unpatched software within our server applications.

POST /user/register: An attempt to register a new user or brute force the user registration form.

The IP made multiple requests with the same If-Match header.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

The malicious IP attempted to brute-force the .htaccess file to gain unauthorized administrative access.

This IP belongs to MTS (Mobile TeleSystems).

POST /j_security_check: May indicate an attempt to bypass Java server page (JSP) login mechanisms.

The IP was part of an IRC-Bot network, a type of botnet that uses the Internet Relay Chat (IRC) protocol.

This IP belongs to Charter Communications.

The IP attempted to exploit known vulnerabilities in the VOIP protocol.

It attempted to use the FTP server to distribute network scanning tools.

The IP address has been associated with unwanted browser toolbar installations.

The IP address made multiple requests with identical request parameters.

This IP belongs to Shopify.

It attempted to use the FTP server to distribute password cracking tools.