The IP attempted to perform Stack Overflow attacks on the Apache server.

It attempted to flood the VOIP server with REGISTER requests.

Side Channel Attacks: Repeated requests aimed at inferring sensitive information through observation of web responses.

This IP belongs to Morgan Stanley.

DNS changer spyware originating from the flagged IP was designed to redirect our network traffic.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

This IP belongs to Massachusetts Mutual Life Insurance.

It attempted to send emails with malicious links from the Postfix server.

This IP belongs to Netflix.

This IP belongs to Proximus.

It repeatedly attempted to run server-side injection attacks, trying to execute malicious code on our server.

Content Sniffing: Logs reflect HTTP requests that include the Accept header with " / ", suggesting an attacker is trying to detect what types of content the server will send.

It attempted to use the FTP server to distribute zombie network tools.

It attempted to perform SQL injection attacks through the Apache server.

This IP was reported for attempting to use the SIP server to mask its true location and identity, a common tactic in VoIP phishing attacks.

The IP attempted to perform XML Injection attacks on the Apache server.

The IP initiated IP spoofing, fooling our systems to trust its malicious communication.

It attempted to use the Postfix server to relay phishing emails to other servers.

The IP was seen making repeated calls to premium-rate numbers, a common form of VoIP fraud.

This IP belongs to AT&T.

This IP belongs to ConocoPhillips.

It attempted to login to the IMAP server with an invalid password.

The IP attempted to create new directories on the FTP server.

It attempted to login to the SASL server with an invalid password.

Attempts to access the server using credentials that have been involved in previous security incidents.