Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

This malicious IP was reported for attempting a FTP Bounce attack, exploiting the FTP protocol's proxy command to scan ports and networks.

It attempted to use the FTP server to relay data to other systems.

Repeated attempts to access the server using encrypted or obfuscated data, which can indicate an attacker is trying to hide their activities.

Unusual command line activities that are not typical for the server environment.

It attempted to perform a SIP Register Flood on the Asterisk server.

It attempted to perform a Quake Network Protocol amplification attack on the SSH server.

Repeated attempts to access the server using old or outdated software versions, which might have known vulnerabilities.

This IP belongs to Softbank.

The IP attempted to perform a VOIP Hopper scan on the VOIP server.

This IP belongs to Vkontakte.

Multiple requests using HTTP methods that are not typically used (e.g., TRACE).

This IP belongs to United Continental Holdings.

This IP belongs to Korea Telecom.

This IP belongs to AT&T.

Automated Bot Traffic: Logs are showing an unusual large amount of traffic from known or suspected bot IPs.

An identity theft activity was linked back to this malicious IP.

The IP was seen trying to perform a PASV FTP Bounce attack, misusing the passive mode to scan other hosts and ports.

Multiple requests with the same X-Csrf-Token header.

This IP was associated with targeted spear phishing attempts against our senior staff.

The IP was noticed spreading RATs (remote administration tools) camouflaged as regular software.

It attempted to send emails from the Mail server that violate the server's email content policy.

The IP attempted to perform a Kad network amplification attack on the SSH server.

This IP belongs to Chevron.

The IP made multiple requests with the same If-Match header.