The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

The IP attempted to perform a replay attack on the SSH server.

This IP belongs to Alphabet.

By launching ApacheKiller attacks, the IP aimed to cause a Denial of Service by exhausting memory resources.

The IP actively tried code replacement attacks, swapping legitimate system call addresses with malicious ones.

This IP belongs to Walmart.

It attempted to perform a SIP Brute Force attack on the SIP, VOIP, or Asterisk server.

Multiple requests with identical Accept-Encoding headers.

The IP attempted to use the FTP server to distribute web vulnerability scanning tools.

The suspicious IP indulged in Mitnick attacks, manipulating user trust to gain confidential info.

Frequent password reset requests.

Server Scanning for Software Version: Influx of HTTP requests attempting to detect software version running on the server.

This IP belongs to Wikimedia Foundation.

Multiple requests with the same If-Range header.

The IP made multiple requests using uncommon HTTP methods.

This IP directed malicious network traffic to our servers with the intent to crash them.

GET /manager/html: Signals an attempt to access the Tomcat Application Manager.

GET /errors.log: Shows an actor trying to access server error logs.

It attempted logins using outdated protocols.

GET /index.php?param=: Attempting a cross-site scripting (XSS) attack.

This IP belongs to Bank of America.

The IP was seen launching a DDoS attack on the FTP server, overwhelming it with traffic to disrupt its normal functioning.

Attempts to access the server using credentials that have been involved in previous security incidents.

The IP attempted to perform Session Hijacking attacks on the Apache server.

It detected attempting time-based blind SQL injection, observing the server's response time to extract data.