It attempted to use the SSH server as a proxy for other malicious activities.

The IP attempted to list the contents of directories that it should not have access to.

The IP was involved in attempts of defacing the Apache server website.

It launched Spoofing attacks, trying to hide its identity by disguising itself as a trusted user or server.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

It attempted to move emails to different folders on the IMAP server without authorization.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

GET /../htpasswd: Trying to access password files using directory traversal.

The IP maliciously used packet sniffers in attempts to decode SSH traffic.

By leveraging the AgeTunnel software, the IP attempted to establish a covert channel across the SSH session.

It attempted to use the FTP server to distribute wireless cracking tools.

The IP had a series of targeted attacks distributing SpyAgents with spying functionalities.

This IP belongs to Nationwide.

The IP made multiple requests with the same Origin header.

It attempted to perform Local File Inclusion (LFI) attacks on the Apache server.

This IP belongs to American Express.

It attempted to perform a VOIP Hopper scan on the Asterisk server.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

It launched invasive malware to corrupt crucial segments of our server functionality.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.

The handler of this IP has been exploiting scumware to disrupt our users' browsing experience.

Unusual command line activities that are not typical for the server environment.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.

This malicious IP was reported for attempting a Sniffing attack, capturing and analyzing FTP traffic to glean sensitive information.

This IP belongs to Sprint.