The malignant IP conducted a Reflector attack, using third-party servers to amplify the attack traffic towards our server.

This IP belongs to PepsiCo.

It exploited insecure server configurations and attempted to establish reverse SSH tunneling.

The malicious IP was involved in a SQL Injection attack, attempting to manipulate a database for unauthorized access or data theft.

Multiple requests with the same TE (Transfer Encoding) header.

The IP attempted to perform a Fraggle attack on the SSH server.

The IP initiated dictionary attacks, hoping to guess the correct password combination.

The IP was detected while sending out malicious spyware-infected emails.

This IP belongs to OVH.

The IP attempted to use the Mail server to relay emails with malicious links to other servers.

The IP attempted to create new directories on the FTP server.

The malicious IP attempted to exploit server misconfigurations to gain higher-level access.

Side Channel Attacks: Repeated requests aimed at inferring sensitive information through observation of web responses.

The IP attempted to exploit known vulnerabilities in the Asterisk protocol.

Multiple requests with identical cookies.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

The IP attempted to send spam emails from the Postfix server.

The malicious IP tried to depreciate the reputation of our mail server by sending out numerous spam mails.

Bursts of login attempts followed by periods of inactivity, suggesting an attacker is trying to avoid detection.

It conducted an incursion on secure shell (SSH), attempting to tamper with encrypted data.

The IP was seen making repeated calls to premium-rate numbers, a common form of VoIP fraud.

It was discovered using our server in an open relay configuration, sending emails from unauthorized domains.

The IP attempted to perform a SIP Invite Flood on the Asterisk server.

The IP sent malformed Asterisk requests, potentially indicating an attempt to crash the server.

Tried to perform a man-in-the-middle attack to intercept and alter communication between the server and clients.