It attempted to make unauthorized calls using the Asterisk server.

This IP belongs to Oracle Cloud Infrastructure.

The IP attempted to perform a downgrade attack on the SSH server.

The IP was involved in a Directory Traversal attack on the FTP server, attempting to access restricted directories and files.

It attempted to make unauthorized calls using the VOIP server.

This IP belongs to Google Cloud Services.

Numerous requests for non-existent pages, suggesting the attacker is probing for vulnerabilities.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.

The IP sent malicious links via IM softwares, aiming to spread instant messaging worms.

The IP was seen performing a CSRF (Cross-site request forgery) attack to manipulate user actions.

Multiple requests with identical cookies.

GET /vuln.html: Looking for any page vulnerabilities.

This IP belongs to Cardinal Health.

Attempts to access the server using unusual HTTP methods or request types.

This IP belongs to Shaw Communications.

The malicious IP attempted to gain unauthorized access to the server by repeatedly trying different username and password combinations.

The IP attempted to perform a dictionary attack on the POP3 server.

It made multiple requests from user agents claiming to be bots.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

Multiple login attempts with slight variations in the password, suggesting a dictionary attack, a type of brute force attack.

It was involved in the operation of a REG-Bot, a type of bot that performs automated tasks.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

The IP attempted to delete directories on the SSH server.

It attempted to send emails from the Mail server to a large number of recipients.

It made multiple requests with identical POST parameters.