It was discovered illicitly scanning the server for potential vulnerabilities.

It attempted to send emails from the Mail server that violate the server's usage policy.

Attempts to access sensitive areas of the server, such as the admin page or user account information.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

Unusual patterns in referrer URLs.

This IP belongs to Deutsche Telecom.

It attempted to use the FTP server to distribute network scanning tools.

This IP belongs to SK Broadband.

This IP belongs to MetLife.

This IP belongs to IBM.

The malicious IP was reported for attempting a Session Teardown attack, sending BYE messages to end SIP sessions prematurely.

Multiple attempts to access the server using different ports or protocols.

POST /upload.php: An attempt to upload a possibly malicious file.

The malicious IP was reported for attempting unauthorized logins to the FTP server, potentially to gain access to sensitive files.

This IP belongs to Chevron.

Attempts to access the server using stolen or leaked credentials.

The IP was reported for attempting a Cross-Site Scripting attack, injecting malicious scripts into websites to steal data or disrupt functionality.

The IP was involved in a SIP Message Tampering attack, altering SIP messages in transit to disrupt communication or gain unauthorized access.

Multiple requests to the server's robots.txt file.

Repeated attempts to perform actions that are typically restricted, such as creating or modifying user accounts.

The IP sent malformed VOIP requests, potentially indicating an attempt to crash the server.

The IP made multiple requests with the same Proxy-Authorization header.

It sent Asterisk requests to non-existent extensions.

The IP attempted to perform a Ping of Death attack on the SSH server.

It tried to execute a Rainbow Table attack, aiming to break the encryption used in SSH password protection.