Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

The malicious IP was reported for attempting to reroute calls through the SIP server, a tactic often used to commit toll fraud.

The IP was seen trying to exploit known vulnerabilities in the Asterisk server, a common tactic for gaining unauthorized access or control.

It partook in location spoofing, making it appear from different locations.

This IP belongs to Twenty-First Century Fox.

This IP belongs to Apple.

It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

Server Side Request Forgery Attempts: Logs may show HTTP requests attempting to manipulate the server into making unintended requests.

HEAD /: May be part of a larger Reconnaissance.

GET /manager/html: Signals an attempt to access the Tomcat Application Manager.

The identified IP address was involved in planting backdoor programs that give excessive control over infected systems.

This IP belongs to Xbox Live.

Unusual patterns in the Accept-Language header.

Excessive traffic from a single IP address.

Repeated attempts to exploit known vulnerabilities in server software.

This IP belongs to MTS (Mobile TeleSystems).

The delivery of spyware, aimed at gathering sensitive information, was originated from this IP.

Conducted various IP scans, seeking loopholes in our network's security.

High network traffic at unusual times, suggesting an automated process is running.

A multitude of spyware-infected download wrappers were linked to the spotted IP address.

Reverse Tabnabbing Attempts: Logs illustrating target="_blank" in URL, which is a sign of reverse tabnabbing attempt.

Unusual User-Agent: Logs show requests with abnormal, uncommon or non-standard User-Agent strings.

The IP attempted to perform a downgrade attack on the SSH server.