The IP showed unusual patterns in session IDs.

This IP belongs to Bank of America.

Attempts to use automated scripts or tools for password cracking.

It made numerous requests to the same endpoint in a short time.

The IP made multiple requests with the same If-Range header.

This IP belongs to Humana.

The IP sent malicious links via IM softwares, aiming to spread instant messaging worms.

The IP was reported for attempting a DNS Amplification attack, exploiting vulnerabilities in domain name servers to turn initially small queries into much larger payloads.

This IP belongs to DigitalOcean.

The malicious IP initiated numerous HTTP flood attacks, designed to overwhelm the Apache server with requests.

It attempted to use the SIP server to perform a reflection DDoS attack.

Unusual Query String Patterns: Repeated HTTP requests with minor alterations to the query string data, signifying an attacker mapping out how different inputs affect the response.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: request for a file often associated with an outdated version of Composer and phpunit used in a remote code execution attack.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

The IP was involved in a RTP Mix attack, injecting RTP packets into an ongoing VoIP call to disrupt communication.

Our technical team unearthed the IP's involvement in distributing malicious mobile spyware.

It attempted to perform a SIPVicious scan on the Asterisk server.

It launched Spoofing attacks, trying to hide its identity by disguising itself as a trusted user or server.

The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

Attempts to access the server using outdated or insecure protocols, which can indicate an attacker is trying to exploit known vulnerabilities.

The IP initiated fake traffic attacks to manipulate webpage rankings and conduct click fraud.

GET /../htpasswd: Trying to access password files using directory traversal.

The IP tried to initiate DNS tunneling for smuggling data through SSH.

It sent Asterisk requests to non-existent extensions.