The IP was seen trying to exploit known vulnerabilities in the Asterisk server, a common tactic for gaining unauthorized access or control.

It attempted to perform a Newtear attack on the SSH server.

It sent unusually large VOIP packets, potentially indicating a buffer overflow attempt.

The IP had been flagged for initiating SYN flood attacks on our servers.

The IP attempted to perform a SIPVicious scan on the VOIP server.

The IP attempted to perform Missing Function Level Access Control attacks on the Apache server.

Multiple login attempts using common or easily guessable passwords (like 'password123', 'admin', etc.).

Content Sniffing: Logs reflect HTTP requests that include the Accept header with " / ", suggesting an attacker is trying to detect what types of content the server will send.

It actively sought to exploit unpatched software within our server applications.

It launched Spoofing attacks, trying to hide its identity by disguising itself as a trusted user or server.

This IP belongs to FedEx.

This IP belongs to Bell Canada.

The malicious IP initiated unauthorized Mail Queue access attempts, impacting mail service efficiency.

Multiple requests with the same Range header.

The IP attempted to use the FTP server to distribute ransomware.

The IP attempted to exploit Buffer Overflow vulnerabilities on our server.

This IP belongs to World Fuel Services.

It engaged in a click fraud operation using our server’s communication channels.

It attempted to send emails from the Postfix server to a large number of recipients.

The IP address initiated multiple unsuccessful login attempts.

The IP attempted to perform Missing Function Level Access Control attacks on the Apache server.

The IP attempted to perform Remote File Inclusion (RFI) attacks on the Apache server.

The IP was involved in a FTP Flood attack, sending a large number of FTP connection requests to overwhelm the server.

It attempted to create new directories on the SSH server.

Multiple login attempts using different usernames, suggesting an attacker is trying to guess the correct username/password combination.