Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

The malicious IP was reported for trying to perform a VoIP Phreaking attack, exploiting weaknesses in VoIP systems to make free calls or disrupt services.

Multiple requests with the same X-Csrf-Token header.

It attempted to perform a SIP Register Flood on the Asterisk server.

The IP attempted to use the FTP server to distribute credit card fraud tools.

Unusual increase in server CPU usage.

This IP belongs to Exxon Mobil.

The IP was involved in a FTP Anonymity attack, exploiting anonymous FTP access to upload or download files without detection.

FTP Over HTTP: Logs may show HTTP requests containing FTP commands, potentially indicating an FTP Injection attack.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

Bogus pop-ups irritating our end-users were found to be released by this infamous IP.

The IP attempted to send emails from the Postfix server without proper authentication.

GET /server-status: Often an attempt to check Apache server status.

This IP was seen trying to perform a SIP URI Spoofing attack, falsifying the SIP URI to deceive the receiver or hide the caller's identity.

This IP belongs to Orange France Telecom.

The malicious IP initiated unauthorized Mail Queue access attempts, impacting mail service efficiency.

It attempted to perform Web Service attacks on the Apache server.

It attempted to perform Heap Overflow attacks on the Apache server.

This IP was suspected of running a botnet, a network of compromised computers used for malicious activities like spamming or DDoS attacks.

It was detected trying to perform cross-site scripting to bypass the same origin policy on Apache.

This IP belongs to Softbank.

The IP attempted to bypass IP blacklisting by rapidly changing its IP address.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

It attempted to upload malicious files to the SSH server.

Multiple requests with the same If-None-Match header.