It attempted to exploit known vulnerabilities in the IMAP protocol.

The IP sent malformed Asterisk requests, potentially indicating an attempt to crash the server.

It attempted to make unauthorized calls using the VOIP server.

Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

The IP sent numerous Asterisk OPTIONS requests in a short time.

It performed botnet operations, controlling a group of “zombie” computers to amplify its DDoS attacks.

It attempted to send emails from the Mail server to a large number of recipients.

The IP sent malicious links via IM softwares, aiming to spread instant messaging worms.

Multiple requests with the same X-Wap-Profile header.

It was responsible for an unusual increase in server CPU usage.

It attempted to perform Unvalidated Redirects and Forwards attacks on the Apache server.

Path/File Enumeration: Logs show multiple HTTP requests to non-existing pages and incrementing filenames, suggesting file or path enumeration.

This IP directed malicious network traffic to our servers with the intent to crash them.

The IP made repeated attempts to authenticate with the Asterisk server using different usernames.

The malicious IP attempted to exploit server misconfigurations to gain higher-level access.

This IP belongs to Charter Communications.

POST /user/register: An attempt to register a new user or brute force the user registration form.

The IP attempted to execute unauthorized commands on the SSH server.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

Unusual patterns in the sequence of requests.

This IP belongs to GoDaddy.

This IP belongs to Ziggo.

This IP belongs to Cloudfare.

This IP belongs to Shaw Communications.

The IP sent malformed VOIP requests, potentially indicating an attempt to crash the server.