The IP engaged in a mail relay attack, using our server to send spam.

GET /.env: Attempting to access a file that may contain sensitive environment variable data.

It was observed attempting to conduct a replay attack, resending captured SSH packets in hopes of session hijacking.

Unwanted Web Crawler Activity: Observing unusual frequent requests from a known web crawler not granted to scan your site.

It made multiple requests with the same X-Forwarded-For header.

Actively performed packet spoofing, obscuring the origin point of its own malicious packets.

The IP attempted to change file permissions on the SSH server.

Multiple requests with the same Max-Forwards header.

This IP belongs to Intel.

Repeated failed attempts to perform actions that require higher privileges.

The IP made multiple requests to the password reset page.

Unusual system or application errors related to authentication or access controls.

The IP attempted to register with the Asterisk server using an invalid username.

It attempted phishing scams by sending malicious mails through compromised accounts.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

The IP attempted various header manipulation attacks, aiming to bypass spam filters.

This IP belongs to Bank of America.

This IP belongs to United Technologies.

It sent unusually large VOIP packets, potentially indicating a buffer overflow attempt.

Multiple requests with the same Expect header.

This IP belongs to Home Depot.

Unusual patterns of behavior, such as login attempts at regular intervals or sequential patterns in the attempted passwords.

It sent unusually large Asterisk packets, potentially indicating a buffer overflow attempt.

Path/File Enumeration: Logs show multiple HTTP requests to non-existing pages and incrementing filenames, suggesting file or path enumeration.

With the introduction of hidden malicious intent, this IP found to be operating masked redirect attacks.