It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

It attempted to use the VOIP server to perform a reflection DDoS attack.

It started header injection or email injection attempts, by adding extra data into the headers and confusing the server processes.

The IP was involved in a Caller ID Spoofing attack, falsifying the caller ID to deceive the receiver or hide the caller's identity.

It attempted to use the POP3 server to relay phishing emails.

This IP belongs to Vodafone.

It showed unusual patterns in the sequence of requests.

This IP belongs to China Mobile.

The malicious IP was reported for attempting unauthorized logins to the SIP server, potentially to gain control over voice communication.

This malicious IP was reported for attempting a man-in-the-middle attack on the VoIP server, intercepting and potentially altering communication.

This malicious IP was reported for attempting to perform a FTP Format String attack, exploiting format string vulnerabilities to crash the FTP server or execute arbitrary code.

Server Side Request Forgery Attempts: Logs may show HTTP requests attempting to manipulate the server into making unintended requests.

The IP attempted to perform Man in the Browser (MitB) attacks on the Apache server.

It attempted to delete directories on the FTP server.

This IP belongs to Telstra.

This IP belongs to Dell Technologies.

The IP attempted to bypass IP blacklisting by rapidly changing its IP address.

Attempts to use automated scripts or tools for password cracking.

Multiple requests with the same Via header.

It attempted to perform Server Side Request Forgery (SSRF) attacks on the Apache server.

Unexpected or unusual patterns in the server logs, such as repeated patterns of failed logins followed by successful logins.

Multiple 5xx Server Error Codes: A high count of server error status codes such as '500 Internal Server Error' may suggest an attacker is probing the server's security.

The malicious IP was reported for attempting a Session Teardown attack, sending BYE messages to end SIP sessions prematurely.

The IP attempted to perform Format String attacks on the Apache server.

This IP was traced back to several attempts to access domain admin credentials.