The IP tried to crack S/MIME encryption for accessing secured email contents.

GET /backup.sql: Attempting to access a backup of your database.

The IP was seen trying to perform a call transfer to an external number, a potential sign of toll fraud.

The said IP was the source of several rootkit deployment attempts.

It attempted to perform a SIP Register Flood on the SIP server.

It attempted to use a TearDrop attack to corrupt data packets being sent to our server.

This IP belongs to Comcast.

The malicious IP was reported for attempting a SIP Proxy attack, using a SIP server to mask its true location and identity.

The IP made multiple requests with the same Via header.

IP Spoofing: Logs showing HTTP requests with IP ranges that are typically reserved for private networks or an unusual X-Forwarded-For header.

Multiple requests with the same X-Csrf-Token header.

The malicious IP was identified trying to leverage the Postfix service to send bulk spam emails.

Multiple requests with the same If-Range header.

Multiple requests with the same Range header.

The IP was caught attempting to execute heap overflow attacks.

It attempted to flood the VOIP server with REGISTER requests.

Usage of Obscure HTTP Verbs: Seeing non-standard HTTP methods like DEBUG, PUT, or CONNECT could imply a web-based attack.

GET /login.action: Trying to find a Struts2 application to exploit.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.

POST /modules/raptor_file_manager/upload.php: Attempt to use a known flaw in the Raptor file manager for arbitrary file upload.

It attempted to flood the Asterisk server with REGISTER requests.

The IP attempted to execute unauthorized commands on the SSH server.

This IP belongs to AmerisourceBergen.

POST /modules/raptor_file_manager/upload.php: Attempt to use a known flaw in the Raptor file manager for arbitrary file upload.

This IP belongs to FedEx.