Unauthorized HTTP Method Usage: Logs showing unauthorized methods being attempted on the server, like TRACE or PATCH.

The IP attempted to perform a NetBIOS amplification attack on the SSH server.

The malicious IP was found to be running an Internet Relay Chat (IRC) bot, potentially spreading malware or launching Distributed Denial-of-Service (DDoS) attacks.

The IP attempted a Rootkit installation to gain root access and control server activity.

Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

The IP attempted to download sensitive files from the Apache server.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

It attempted to use the FTP server to distribute virus creation tools.

The IP sent malformed Asterisk requests, potentially indicating an attempt to crash the server.

This malicious IP was reported for attempting to execute a Cross-Site Request Forgery (CSRF) attack, tricking a victim into executing unwanted actions on the FTP server.

POST /upload.php: An attempt to upload a possibly malicious file.

A sudden surge in the number of requests per second, indicating an automated process.

This IP belongs to The Hartford Financial Services.

The malicious IP was reported for attempting to reroute calls through the SIP server, a tactic often used to commit toll fraud.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

Side Channel Attacks: Repeated requests aimed at inferring sensitive information through observation of web responses.

We observed the IP distributing harmful document tracking tools.

Our logs indicated an unusually high traffic volume originating from this IP address.

By leveraging the AgeTunnel software, the IP attempted to establish a covert channel across the SSH session.

Multiple account lockouts in a short period of time.

The IP attempted to use the FTP server to distribute keylogging software.

The IP address made multiple attempts to exploit a Remote File Inclusion (RFI) vulnerability.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

The IP targeted our server with PHP Injection attacks to gain access to sensitive data.

It attempted to perform Insecure Direct Object References attacks on the Apache server.