A security analyst reviewing web server logs notices repeated GET requests containing strings like '../../../../etc/passwd' and '..%2f..%2fboot.ini'. The requests originate from a single external IP and target the application's file-download endpoint. Which type of attack does this activity indicate?