GET /internal/: Browsing an internal directory.

It attempted to use the FTP server to distribute traffic monitoring tools.

The IP was seen traffic sniffing, trying to spy on and analyse network packets for potential server vulnerabilities.

The IP attempted to perform a dictionary attack on the IMAP server.

This IP belongs to Phillips 66.

The IP attempted to use the FTP server to distribute VPN tools.

Identification of Known Vulnerabilities: Attempts to exploit known vulnerabilities related to your server application.

Usage of Obscure HTTP Verbs: Seeing non-standard HTTP methods like DEBUG, PUT, or CONNECT could imply a web-based attack.

Multiple requests with the same Range header.

It made multiple requests with identical Accept-Charset headers.

It attempted to use the FTP server to distribute wireless cracking tools.

Initiated rogue DHCP server set up, attempting to disrupt our network and intercept emails.

This IP belongs to Medium.

The IP made multiple requests with the same X-UIDH header.

GET /internal/: Browsing an internal directory.

The IP was recorded making persistent attempts to crack our encryption.

The IP tried to exploit remote file inclusion vulnerabilities, aiming to run malicious scripts on the server.

It attempted to perform a phishing attack using the POP3 server.

The IP tried to launch 'Dark Tequila' malware that steals banking information and login credentials from the server.

This IP belongs to Softbank.

This IP was implicated in attempts to inject ransomware into our systems.

It attempted to make unauthorized calls using the Asterisk server.

the IP made attempts at wiretapping the network to monitor SSH traffic patterns and gather useful information.

We linked several cryptojacking attempts, aimed at harnessing our system resources, to this IP.

The IP attempted to launch Ciphertext attacks, trying to decrypt SSH-encrypted communication.