Multiple requests to the password reset page.

Multiple requests with the same X-Wap-Profile header.

It tried to use Cross-site scripting (XSS) attacks to inject malicious scripts into webpages viewed by users.

This IP belongs to Korea Telecom.

The IP was found trying to maliciously clone the SSH certificates for privileged access.

The IP attempted to execute an intruder software, terrifying users with unwanted content.

It attempted to use the FTP server to store illegal content.

The IP attempted to perform a BitTorrent amplification attack on the SSH server.

The IP attempted to use the Mail server to relay emails with misleading headers to other servers.

It attempted to use the FTP server to distribute network scanning tools.

GET /solr/admin/cores?wt=json: Trying to exploit Apache Solr servers which have the runExecutableListener enabled.

The IP attempted to perform a Kad network amplification attack on the SSH server.

The IP attempted to upload malicious files to the FTP server.

The IP attempted to perform Session Hijacking attacks on the Apache server.

The IP attempted to download emails from the IMAP server without authorization.

The IP attempted to use the Mail server to relay malware-infected attachments to other servers.

This malicious IP was reported for trying to perform a FTP Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

It was making constant NDR (Non-Deliverable Receipt) or backscatter attacks by generating large amount of invalid email addresses.

The malignant IP conducted a Reflector attack, using third-party servers to amplify the attack traffic towards our server.

TLS Downgrade Attacks: Logs showing repeated attempts to establish non-TLS connections with the server.

Frequent access requests from user agents that are known to be associated with malicious tools or bots.

It launched SQL injection attempts, to break our server database through poorly secured entry fields.

Server Misconfiguration Exploitation: Logs illustrating attempts at exploiting known server misconfigurations.

This specific IP was marked for unauthorized browser changes implying browser hijackers.

It utilized a Directory Harvest Attack, attempting to find valid e-mail addresses through guesswork.