It attempted to send phishing emails from the Mail server.

The IP attempted to perform a VOIP Hopper scan on the SIP server.

Multiple requests with identical POST parameters.

This IP belongs to Airtel.

GET /.env: Attempting to access a file that may contain sensitive environment variable data.

It appeared to be taking part in SSL Stripping attacks, downgrading secure HTTPS connections to facilitate eavesdropping.

The IP tried to carry out illegal 'HTTP Request Smuggling' to fool the Apache server.

Unusually high number of requests to the login page.

This IP belongs to MetLife.

This IP belongs to NetEase.

Inclusion of Binary Data in HTTP Request: If binary data is included in the HTTP request, this could suggest an attacker is attempting a binary exploit.

IP Spoofing: Logs showing HTTP requests with IP ranges that are typically reserved for private networks or an unusual X-Forwarded-For header.

The IP attempted to perform a dictionary attack on the POP3 server.

Attempts to access the server using unusual HTTP methods or request types.

The IP attempted to perform a Ping of Death attack on the SSH server.

Signs of CSRF Attacks: Logs demonstrating HTTP GET requests with sensitive actions that should ideally require POST requests.

The malicious IP initiated numerous HTTP flood attacks, designed to overwhelm the Apache server with requests.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

It was found that the IP had deployed rogue security software in our system.

POST /user/register: An attempt to register a new user or brute force the user registration form.

The IP attempted to perform a QOTD amplification attack on the SSH server.

It tried to exploit Apache Struts vulnerabilities to compromise our web applications.

The IP was seen trying to perform a SIP Registration Hijacking attack, attempting to impersonate a legitimate user to receive their calls.

This malicious IP was reported for trying to perform a Symlink attack, creating symbolic links to files outside the FTP server's root directory.

We traced a significant increase in the distribution of malicious fake security software to the reported IP.