The malicious IP conducted HTTP verb tampering, exploiting varying responses to different HTTP methods.

It attempted to use the FTP server to distribute SQL injection tools.

GET /server-status: Often an attempt to check Apache server status.

This IP was reported for attempting to register a large number of SIP extensions in a short time, a sign of a potential brute force attack.

This malicious IP was reported for trying to inject malicious scripts into the VoIP server, potentially to disrupt its operation or steal data.

This IP belongs to Dell Technologies.

Multiple requests with the same X-Att-Deviceid header.

Multiple login attempts using different usernames, suggesting an attacker is trying to guess the correct username/password combination.

This IP is linked to the distribution of commercial keyloggers designed to capture users' keystrokes.

This malicious IP was reported for attempting to execute a Cross-Site Request Forgery (CSRF) attack, tricking a victim into executing unwanted actions on the FTP server.

High Frequency POST Requests: Numerous or unusual POST requests in a short time span could indicate a dictionary or brute force attack on a login page.

It made multiple requests with identical POST parameters.

This IP belongs to Valero Energy.

The IP attempted to use the POP3 server to relay spam.

This IP was traced back to unusual network abnormalities evidencing Ghostware.

The IP was marked trying to carry out Backscatter spam by replying to spam using the server's configuration.

The IP performed regular system foot printing to gain intel on weak points in our server.

Multiple requests with the same X-Forwarded-For header.

The IP sent numerous Asterisk OPTIONS requests in a short time.

The IP engaged in an HTTP Desync attack, misaligning HTTP request and responses to yield SSH vulnerability.

The IP attempted session sidejacking, seeking to take over SSH sessions post-authentication.

The IP was involved in a RTP Mix attack, injecting RTP packets into an ongoing VoIP call to disrupt communication.

It attempted to use the FTP server to distribute terrorist propaganda.

The IP was involved in a FTP Injection attack, exploiting vulnerabilities in the FTP server to execute unauthorized commands.

Multiple Sequential Page Requests: Quick, sequential requests to all pages of a site could be someone scanning for vulnerabilities.