It attempted to exploit known vulnerabilities in the SSH protocol.

It was caught injecting malicious code into the SSH session attempting to compromise server integrity.

This IP belongs to Sky Broadband.

The IP made multiple requests with identical Accept-Encoding headers.

The IP was seen trying to perform a call transfer to an external number, a potential sign of toll fraud.

The IP was involved in a SIP brute force attack, attempting to guess SIP authentication credentials to gain unauthorized access.

This IP was detected initiating zero-day exploit attacks on our system.

It started header injection or email injection attempts, by adding extra data into the headers and confusing the server processes.

GET /errors.log: Shows an actor trying to access server error logs.

The IP attempted to login to the SASL server with an invalid username.

The IP made multiple requests with identical Accept-Encoding headers.

Unidentified password attempts and login activity were noticed from the specific IP address.

The IP was seen trying to perform a Denial of Service (DoS) attack, attempting to make a machine or network resource unavailable to its intended users.

The IP initiated a man-in-the-middle (MitM) attack, attempting to capture sensitive information during legitimate email exchange.

Repeated HTTP requests with error codes, indicating failed attempts to access restricted areas.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

It attempted to perform Race Condition attacks on the Apache server.

This IP belongs to IBM.

The IP was seen launching a DDoS attack on the Asterisk server, overwhelming it with traffic to disrupt its normal functioning.

This IP belongs to Citigroup.

Forceful Browsing: Attempts to access pages or resources without proper navigation.

It launched header-based exploits, attempting to manipulate HTTP headers to cause inappropriate server responses.

It carried out IP spoofing to mimic a trusted IP with the intent of gaining unauthorized SSH access.

The IP made multiple requests to the server's robots.txt file.

This IP belongs to Medium.