Attempts to access the server using unusual HTTP methods or request types.

It seems like this IP tried to spread malware into the network.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

The malicious IP attempted ARP spoofing to fool the server into sending information to the wrong destination.

This IP was seen trying to perform a Sniffing attack, capturing and analyzing VoIP traffic to glean sensitive information.

This IP belongs to Philip Morris International.

Multiple requests with the same If-None-Match header.

The IP tried launching Server Query Flooding to overwhelm our server with requests.

The IP address was identified sending packets with malicious payloads to our server, trying to exploit potential security holes.

GET /vuln.html: Looking for any page vulnerabilities.

The IP attempted to exploit known vulnerabilities in the SIP protocol.

It initiated requests to non-existent endpoints.

Smuggling Attack: Logs showing a single IP initiating multiple sessions, implying a Smuggling Attack.

The IP made multiple requests with the same DNT header.

It attempted to use the Asterisk server as a relay for calls to premium-rate numbers.

The IP was involved in a SIP Message Tampering attack, altering SIP messages in transit to disrupt communication or gain unauthorized access.

This malicious IP was reported for trying to perform a FTP Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

The IP had been flagged for initiating SYN flood attacks on our servers.

GET /muieblackcat: This is often a precursor for additional scanning and likely attacks.

This IP belongs to AT&T.

The IP tried to launch 'Dark Tequila' malware that steals banking information and login credentials from the server.

The IP had a series of targeted attacks distributing SpyAgents with spying functionalities.

The IP attempted to mark emails as read on the IMAP server without authorization.

It attempted to delete files from the SSH server.

This particular IP tried to perform an unauthorized system configuration change.