GET /vuln.html: Looking for any page vulnerabilities.

This IP belongs to Telkom SA.

Unusually high number of requests to a specific service or application within the server.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.

This IP belongs to General Electric.

The IP attempted to use the FTP server to distribute steganography tools.

This IP belongs to Microsoft Azure.

This IP belongs to the University of California, Berkeley.

Remote File Inclusion (RFI): You might see HTTP requests with "=http" or "=ftp" which can signal an attempt for remote file inclusion.

Directories Traversal Attempts: Logs showing HTTP requests that include ".." or "/.." might illustrate someone's effort to locate or exploit sensitive data.

This IP was found responsible for a session hijacking attempt on our network.

The IP attempted logins at unusual times.

Multiple requests with the same Proxy-Connection header.

It performed 'Spectre' attacks, exploiting predictive branching in CPUs to potentially gain sensitive information from the SSH service.

The IP attempted to send spam emails from the Mail server.

It initiated several reverse IP lookup requests, probing for server vulnerabilities.

The IP address attempted to register as a SIP user with an invalid username.

This IP was reported for attempting a Dictionary attack on the VoIP server, systematically entering every word in a dictionary as a password to find the correct one.

Unusually high CPU usage, which can indicate a brute force attack is in progress.

Repeated Unique 404 Errors: Logs revealing a steady stream of unique 404 errors could suggest a DDoS attack aiming to exhaust storage resources.

The IP attempted to perform a replay attack on the IMAP server.

It sent VOIP requests to non-existent extensions.

The IP attempted to use the FTP server to distribute steganography tools.

It attempted to delete emails from the POP3 server without authorization.

This IP belongs to IBM Cloud Services.