It was identified as a BadBot, a type of bot that performs malicious activities.

Usage of Obscure HTTP Verbs: Seeing non-standard HTTP methods like DEBUG, PUT, or CONNECT could imply a web-based attack.

It attempted to perform a VOIP Hopper scan on the Asterisk server.

The IP was involved in a VoIP Hopping attack, jumping from one VoIP network to another to avoid detection or gain unauthorized access.

It attempted to send emails with deceptive subject lines from the Postfix server.

Multiple requests with the same If-Match header.

The IP was involved in an Email Spoofing attack, sending emails with a forged sender address, often used in phishing and spam campaigns.

The IP attempted reconnaissance activities, trying to footprint our server’s network.

The IP sent malformed Asterisk requests, potentially indicating an attempt to crash the server.

Remote Execution Attempts: Logs showing unusual terminal commands or scripts run through web access.

GET /ELMAH.axd: Attempting to exploit ELMAH (Error Logging Modules and Handlers) misconfiguration in ASP.NET sites.

The IP was involved in a VoIP Hopping attack, jumping from one VoIP network to another to avoid detection or gain unauthorized access.

The malicious IP was seen trying to perform a Replay attack, capturing SIP authentication data and resending it to gain unauthorized access.

The IP attempted to use the FTP server to distribute network mapping tools.

The IP attempted to perform a replay attack on the IMAP server.

The IP was found to be behind numerous fileless malware attacks.

The malicious IP was involved in a vishing attack, using the VoIP server to deceive users into revealing sensitive information.

This IP has been observed spreading mobile malware, targeting our company application users.

It launched Spoofing attacks, trying to hide its identity by disguising itself as a trusted user or server.

This IP belongs to Oracle Cloud Infrastructure.

The IP tried to exploit remote file inclusion vulnerabilities, aiming to run malicious scripts on the server.

It made various efforts to insert spyware to monitor SSH communications covertly.

Rudimentary attempts were made by this IP to execute Man-in-the-Browser attacks.

This IP was found responsible for a session hijacking attempt on our network.

The IP's involvement in spreading password stealers has compromised our network's protection.