The IP attempted to use the FTP server to distribute keylogging software.

It attempted to use the FTP server to distribute terrorist propaganda.

It initiated SSL-Stripping attacks, aiming to downgrade secure HTTPS connections to less-secure HTTP.

Repeated HTTP requests with error codes, indicating failed attempts to access restricted areas.

The IP attempted to perform Session Hijacking attacks on the Apache server.

It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

Multiple failed attempts to use the server’s API.

Attempts to use automated scripts or tools for password cracking.

It sent SIP INVITE requests to non-existent extensions.

The IP was reported for attempting a Cross-Site Scripting attack, injecting malicious scripts into websites to steal data or disrupt functionality.

The IP was involved in a toll fraud attack, making long-distance calls without authorization, leading to high charges.

GET /trace.axd: An attempt to find a debug handler in ASP.NET.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

The malicious IP was spotted attempting to brute-force the SSH login credentials.

Multiple failed login attempts from the same IP address in a short span of time.

The IP attempted to perform a replay attack on the IMAP server.

Repeated requests for the same file or page, indicating an attempt to crack a password or exploit a vulnerability.

The IP conducted exhaustive dictionary attacks, trying to guess password and username combinations.

Tried to carry out a rainbow table attack, attempting to crack hashed passwords.

It attempted to perform a phishing attack using the POP3 server.

Command Injection in Requests: Logs indicate HTTP requests with Unix or Windows command-line instructions.

This malicious IP was reported for attempting a Session Hijacking attack, exploiting a valid computer session to gain unauthorized access to information or services.

Rapid sequence of login attempts.

Repeated attempts to exploit known vulnerabilities in the server operating system or applications.

This malicious IP was reported for attempting to perform a Replay attack, capturing FTP authentication data and resending it to gain unauthorized access.