Multiple requests with the same If-Range header.

The IP was seen trying to upload files to the FTP server, possibly with the intent of distributing malware.

Unexpected HTTP Methods Usage: Frequent HTTP TRACE method attempts could be an attempt to intercept network requests.

The IP was caught attempting to execute heap overflow attacks.

This IP belongs to General Electric.

Multiple failed attempts to use the server’s API.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

The IP made multiple requests with the same Origin header.

It attempted to use the FTP server to distribute wireless cracking tools.

It attempted to perform a brute force attack on the IMAP server.

The IP was found trying to maliciously clone the SSH certificates for privileged access.

The IP was seen trying to perform a Fraggle attack, a type of DDoS attack where the attacker sends a large amount of UDP traffic to a router's broadcast network.

The IP attempted reconnaissance activities, trying to footprint our server’s network.

GET /CFIDE/administrator/enter.cfm: An attempt to get into the ColdFusion admin console.

It attempted to login to the POP3 server with an invalid password.

The IP actively tried code replacement attacks, swapping legitimate system call addresses with malicious ones.

Damaging activities showing connections to rootkit attacks were associated with this IP.

It attempted to use the Postfix server to relay spam to other servers.

Multiple requests to the password reset page.

A sudden surge in the number of requests per second, indicating an automated process.

It attempted to perform a NTP amplification attack on the SSH server.

This IP belongs to United Continental Holdings.

This IP belongs to Oracle Cloud Infrastructure.

GET /axis2/axis2-admin/login: Attempt at finding Axis2 web service exploitable applications.

The malicious IP attempted ARP spoofing to fool the server into sending information to the wrong destination.