It attempted to flood the VOIP server with REGISTER requests.

This IP belongs to Twenty-First Century Fox.

It attempted to perform a dictionary attack on the SASL server.

This IP belongs to KDDI.

It attempted to send emails from the Mail server to email addresses that have previously marked emails from the server as spam.

Repeated attempts to alter or delete log files to cover tracks.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

The IP address was identified sending packets with malicious payloads to our server, trying to exploit potential security holes.

This IP belongs to Abbott Laboratories.

The IP was involved in a phishing attack, creating a fake webpage to deceive users into providing their sensitive personal or financial information.

The IP tried to exploit buffer overflow vulnerabilities to run unauthorized code.

The IP was seen trying to perform a TDoS (Telephony Denial of Service) attack, flooding the VoIP server with calls to make it unavailable to users.

The IP performed Covert Timing Channel attacks, gathering information about encrypted SSH traffic by analyzing packet timing.

The IP was involved in a FTP Injection attack, exploiting vulnerabilities in the FTP server to execute unauthorized commands.

This malicious IP was seen sending unusually high volumes of requests, a sign of potential automated bot activity.

Repeated attempts to exploit known vulnerabilities in the server operating system or applications.

It attempted to perform Uncontrolled Format String attacks on the Apache server.

The IP initiated SYN flooding attacks, aiming to disrupt service by overwhelming the server.

Identification of Known Vulnerabilities: Attempts to exploit known vulnerabilities related to your server application.

It attempted to login to the SASL server with an invalid password.

It was found actively trying to exploit HTTP Response Splitting vulnerabilities to perform further attacks.

This IP belongs to the United States Department of Defense.

Unusually high CPU usage, which can indicate a brute force attack is in progress.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

This IP was seen scanning for open ports and vulnerabilities, a common reconnaissance activity before launching attacks.