It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

FTP Over HTTP: Logs may show HTTP requests containing FTP commands, potentially indicating an FTP Injection attack.

Frequent access requests from user agents that are known to be associated with malicious tools or bots.

This IP belongs to Softbank.

It repetitively attempted Port Scanning to identify open ports and related vulnerabilities.

The IP engaged in DNS Spoofing, rerouting our server's lookups to a malicious destination.

The malicious IP was reported for attempting to manipulate file permissions on the FTP server, potentially to gain unauthorized access or expose sensitive data.

The IP was found trying to maliciously clone the SSH certificates for privileged access.

It launched SQL injection attempts, to break our server database through poorly secured entry fields.

The IP performed regular system foot printing to gain intel on weak points in our server.

Reverse Tabnabbing Attempts: Logs illustrating target="_blank" in URL, which is a sign of reverse tabnabbing attempt.

The IP was seen trying to exploit known vulnerabilities in the Asterisk server, a common tactic for gaining unauthorized access or control.

Usage of Obscure HTTP Verbs: Seeing non-standard HTTP methods like DEBUG, PUT, or CONNECT could imply a web-based attack.

Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.

It made numerous requests to the same endpoint in a short time.

It attempted to send emails from the Postfix server that violate the server's usage policy.

Connection Timeout Abuse: Logs illustrating excessive requests that aim to use up server connections.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

The IP attempted to perform a VOIP Hopper scan on the VOIP server.

The IP tried to exploit remote file inclusion vulnerabilities, aiming to run malicious scripts on the server.

It was identified as a BadBot, a type of bot that performs malicious activities.

Remote Execution Attempts: Logs showing unusual terminal commands or scripts run through web access.

This IP belongs to AT&T.

Last night, we received an alert regarding this IP attempting to upload keyloggers to our network.

The IP attempted to perform a SNMP amplification attack on the SSH server.