A series of unusual file transfers originated from this IP.

It attempted to perform a SIPVicious scan on the Asterisk server.

Server Misconfiguration Exploitation: Logs illustrating attempts at exploiting known server misconfigurations.

The IP attempted to delete files from the FTP server.

This IP belongs to MetLife.

This IP belongs to Dreamhost.

This IP belongs to United Technologies.

The IP attempted a Rootkit installation to gain root access and control server activity.

It attempted to use the IMAP server to relay spam.

The IP attempted to use the Mail server to relay phishing emails to other servers.

It conducted Rainbow table attacks, which use precomputed tables for reversing hash functions.

Attempts to use default or common usernames and passwords, a common tactic in brute force attacks.

The IP was flagged for attempting dictionary attacks on our user accounts.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

This IP was traced back to several attempts to access domain admin credentials.

The IP was seen traffic sniffing, trying to spy on and analyse network packets for potential server vulnerabilities.

HEAD /: May be part of a larger Reconnaissance.

The IP address attempted to register as a SIP user with an invalid username.

Shell Injection: Logs show requests containing command line shell syntax, suggesting shell command injection.

The malicious IP was involved in Smurf attacks, amplifying its denial-of-service attack using internet host IP network links.

This malicious IP was reported for trying to perform a Man-in-the-Middle attack, intercepting and potentially altering communication between the FTP server and its clients.

The IP attempted 'DLL Injection' to alter the server's behavior in a malicious manner.

The IP attempted to use the FTP server to distribute malware.

The IP attempted to perform a dictionary attack on the POP3 server.

Too Many HTTP GET Requests: An unusually high number of HTTP GET requests from a single IP or a small set of IPs could indicate a DoS attack.