TLS Downgrade Attacks: Logs showing repeated attempts to establish non-TLS connections with the server.

It attempted to flood the VOIP server with REGISTER requests.

The IP address was identified sending packets with malicious payloads to our server, trying to exploit potential security holes.

Unusually high number of requests to a specific service or application within the server.

It sent unusually large SIP packets, potentially indicating a buffer overflow attempt.

This IP attempted to distribute malicious Javascript files.

The IP address initiated attacks using DDoS, impacting our server response times.

This IP belongs to Google Cloud Services.

Unusual TCP/IP Headers: Logs reflect HTTP requests with unusual or altered TCP/IP headers, an attempt to confuse or slip through security measures.

It systematically tried to exploit IMAP and POP3 vulnerabilities present in our mail service setup.

It attempted to send emails with deceptive subject lines from the Mail server.

It attempted to use the Asterisk server to perform a reflection DDoS attack.

Multiple attempts to access the server using encrypted tunnels or proxies.

Unusual Cookie Data: Logs show modified cookie data, usually encrypted or base64 encoded, suggestive of a session stealing or poisoning attack.

The IP was involved in a Ping of Death attack, sending packets larger than the maximum allowed size, causing the system to freeze or crash.

Repeated requests for the same file or page, indicating an attempt to crack a password or exploit a vulnerability.

This IP belongs to MetLife.

The IP attempted to perform HTTP Verb Tampering attacks on the Apache server.

Multiple requests with the same If-Match header.

It initiated SSL-Stripping attacks, aiming to downgrade secure HTTPS connections to less-secure HTTP.

It's observed that the IP operated a series of attacks exploiting insecure direct object references.

Login attempts from foreign IP addresses.

This IP was reported for attempting a Man-in-the-Middle attack, intercepting and potentially altering communication between two parties.

The IP attempted fileless malware attacks, directly injecting malicious script into server memory.

This IP belongs to Time Warner Cable Internet.