Suspicious URL Encoding: Seeing HTTP requests with a lot of %, suggesting URL encoding to evade detection.

It sent unusually large SIP packets, potentially indicating a buffer overflow attempt.

The IP address attempted to login to the SSH server with an invalid username.

Multiple requests with the same Range header.

This IP belongs to Phillips 66.

implemented multiple decryption attacks to gain unauthorized access to encrypted email data.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

This malicious IP was reported for attempting to download files from the FTP server without authorization, potentially stealing sensitive data.

This IP was reported for attempting a Dictionary attack on the VoIP server, systematically entering every word in a dictionary as a password to find the correct one.

This IP belongs to Alphabet.

The IP was seen trying to perform a Spoofing attack, falsifying its IP address to deceive the FTP server.

It was found actively trying to exploit HTTP Response Splitting vulnerabilities to perform further attacks.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

The IP was seen traffic sniffing, trying to spy on and analyse network packets for potential server vulnerabilities.

This IP belongs to The Hartford Financial Services.

Forceful Browsing: Attempts to access pages or resources without proper navigation.

The IP was seen trying to perform a call transfer to an external number, a potential sign of toll fraud.

The IP was involved in a rapid sequence of login attempts.

Multiple attempts to access the server using credentials that were previously compromised in a data breach.

The IP attempted 'DLL Injection' to alter the server's behavior in a malicious manner.

The IP attempted to perform a password spraying attack on the SASL server.

This IP belongs to Slack.

The IP was seen launching a DDoS attack on the Asterisk server, overwhelming it with traffic to disrupt its normal functioning.

The malicious IP tried to brute force its way into the SASL authentication process.