It was discovered illicitly scanning the server for potential vulnerabilities.

It attempted to delete files from the SSH server.

The IP was seen trying to perform a SIP Registration Hijacking attack, attempting to impersonate a legitimate user to receive their calls.

It showed an unusually high number of requests to the login page.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

The IP address attempted to exploit known vulnerabilities in the Apache server software.

This IP belongs to Verizon Communications.

It attempted to carry out a 'Ping of Death' operation, hoping to crash the server.

It carried out IP spoofing to mimic a trusted IP with the intent of gaining unauthorized SSH access.

The notorious IP attempted to distribute Banker Trojans aimed to steal financial data.

Unusual increase in network bandwidth usage.

This IP belongs to Alibaba Cloud Services.

The IP has been traced back to system monitors, aiming to watch and record user activity.

This IP belongs to Microsoft.

It attempted to send emails from the Mail server that violate the server's acceptable use policy.

The malicious IP was reported for attempting to reroute calls through the SIP server, a tactic often used to commit toll fraud.

This IP belongs to Wells Fargo.

GET /server-status: Often an attempt to check Apache server status.

This IP belongs to Cloudfare.

The IP was seen attempting a SYN Flood attack, overwhelming the server by rapidly initiating a connection but not completing it, thereby consuming server resources.

This IP belongs to Northwestern Mutual.

This IP belongs to UnitedHealth Group.

Tried to carry out a rainbow table attack, attempting to crack hashed passwords.

GET /index.php?param=: Attempting a cross-site scripting (XSS) attack.

Unwanted Web Crawler Activity: Observing unusual frequent requests from a known web crawler not granted to scan your site.