This IP belongs to General Dynamics.

Repeated attempts to access the server using encrypted or obfuscated data, which can indicate an attacker is trying to hide their activities.

Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.

The IP was seen trying to change the configuration settings of the Asterisk server, potentially to disable security features.

It persistently tried to exploit weaknesses in the SSH communication encryption.

GET /db/finance.dump: An attempt to access a database dump file.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

Login Attempts with Automated User-Agents: Logs reflect requests to login page with 'bot' or 'spider' in user-agent strings.

Multiple requests with the same DNT (Do Not Track) header.

This malicious IP was reported for attempting to download files from the FTP server without authorization, potentially stealing sensitive data.

This IP belongs to Shopify.

This IP addressed employed a method of brute force attack attempting to compromise our systems.

The IP address attempted to register as a SIP user with an invalid username.

The IP was involved in a FTP Flood attack, sending a large number of FTP connection requests to overwhelm the server.

The IP attempted Forceful Browsing, trying to discover hidden directories or files which could contain SSH access data.

The IP was involved in a FTP Anonymity attack, exploiting anonymous FTP access to upload or download files without detection.

It started header injection or email injection attempts, by adding extra data into the headers and confusing the server processes.

The IP attempted to perform a SIPVicious scan on the VOIP server.

This malicious IP was reported for attempting to perform a Replay attack, capturing FTP authentication data and resending it to gain unauthorized access.

The IP attempted to send emails from the Mail server without proper authentication.

The IP was seen attempting a SYN Flood attack, overwhelming the server by rapidly initiating a connection but not completing it, thereby consuming server resources.

It attempted to perform Server Side Request Forgery (SSRF) attacks on the Apache server.

It attempted to perform a SIP Register Flood on the Asterisk server.

It showed an unusually high number of requests to the login page.

The IP was caught distributing VoIP crackers to exploit our communication channels.