The IP attempted to perform XML External Entity (XXE) attacks on the Apache server.

The IP launched timing attacks, trying to understand our server timings for potential future exploits.

The IP showed unusual patterns in session IDs.

Code Injection: Usage of standard codes (like Base64) to obscure attack payloads or commands.

This IP belongs to Anthem.

This IP belongs to Lowe's.

It attempted to use the FTP server to distribute hacking tools.

The reported IP was identified as a BadBot, engaging in harmful activities such as unauthorized web scraping and data mining.

This IP belongs to Northwestern Mutual.

This IP belongs to Linode.

This IP belongs to Ford Motor.

The IP attempted to use the FTP server to distribute keylogging software.

GET /server-status: Often an attempt to check Apache server status.

The IP was actively seeking unpatched SSH software in hope of finding exploitable vulnerabilities.

The IP was the origin of numerous webcam loggers, a serious privacy invasion.

This IP belongs to Tumblr.

The IP attempted to perform a dictionary attack on the POP3 server.

The IP was seen traffic sniffing, trying to spy on and analyse network packets for potential server vulnerabilities.

This IP belongs to IBM Cloud Services.

The IP attempted reconnaissance activities, trying to footprint our server’s network.

GET /../htpasswd: Trying to access password files using directory traversal.

The IP attempted to perform a credential stuffing attack on the IMAP server.

It attempted to perform IP Spoofing attacks on the Apache server.

The IP attempted to perform a downgrade attack on the SSH server.

The IP performed Covert Timing Channel attacks, gathering information about encrypted SSH traffic by analyzing packet timing.