It attempted to flood the Asterisk server with REGISTER requests.

Print Requests Repeatedly: Logs illustrate HTTP requests with "?print" parameter multiple times, indicating someone trying to expose sensitive information.

It made multiple requests with the same X-Requested-With header.

This IP belongs to Freddie Mac.

The IP was seen trying to exploit known vulnerabilities in the Asterisk server, a common tactic for gaining unauthorized access or control.

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

The IP sent numerous SIP OPTIONS requests in a short time.

Multiple requests with the same Proxy-Connection header.

It attempted to make unauthorized calls using the SIP server.

This IP belongs to Wells Fargo.

GET /vuln.html: Looking for any page vulnerabilities.

Multiple Requests from Different IPs with Same User-Agent: This could be a signal of a coordinated attack originating from compromised machines.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

Incriminating activities involving the distribution of trojan horses were linked to this IP address.

TLS Downgrade Attacks: Logs showing repeated attempts to establish non-TLS connections with the server.

This IP belongs to Sky Broadband.

The IP was involved in a phishing attack, creating a fake webpage to deceive users into providing their sensitive personal or financial information.

The IP address attempted to stealthily spread screen scrapers, programs that take screenshots of the user's display.

This IP belongs to Marathon Petroleum.

The IP made multiple unsuccessful login attempts to the Mail server in a short period of time.

The IP was engaged in email append attacks, trying to add addresses to an existing email or response mid-transit.

This IP belongs to IBM Cloud Services.

The IP attempted to perform XML External Entity (XXE) attacks on the Apache server.

It attempted to login to the SASL server with an invalid password.

It utilized Web scrapers, automatically harvesting content from our server.