It attempted to perform a RIPv1 amplification attack on the SSH server.

Multiple requests with the same Referer header.

Unusually high number of requests to the login page.

Smuggling Attack: Logs showing a single IP initiating multiple sessions, implying a Smuggling Attack.

This IP belongs to Nexon.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

This IP has been flagged for attempting to escalate privileges in our network.

The IP tried to initiate DNS tunneling for smuggling data through SSH.

The malicious IP initiated numerous HTTP flood attacks, designed to overwhelm the Apache server with requests.

The IP was involved in distributing malware, infecting systems or networks to steal data, cause damage, or gain unauthorized access.

It attempted to perform a SIPVicious scan on the Asterisk server.

Multiple requests with the same Proxy-Connection header.

Repeated attempts to use the same password across multiple accounts.

This IP belongs to Baidu.

Login Attempts on Non-Existent Users: Many login requests for non-existent usernames could suggest a blind username enumeration attack.

The IP attempted to download sensitive files from the SSH server.

Our network security detected the IP spreading malicious macros through document files.

The IP attempted to perform a Nestea attack on the SSH server.

This IP belongs to the United States Department of Defense.

The IP was involved in a FTP Spam attack, using the FTP server to distribute unsolicited emails or messages.

This IP belongs to World Fuel Services.

It attempted to make unauthorized calls using the VOIP server.

This IP belongs to World Fuel Services.

This IP belongs to Amazon.

This IP belongs to SingTel.