The IP attempted to perform a SIP Invite Flood on the SIP server.

Suspicious Http Referrer Field: HTTP requests with external referrer headers that usually originate from internal source.

Multiple Sequential Page Requests: Quick, sequential requests to all pages of a site could be someone scanning for vulnerabilities.

Our team traced back the IP responsible for multiple mobile device tracking software distributions.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

The said IP was the source of several rootkit deployment attempts.

The IP address attempted to login to the SSH server with an invalid username.

The IP was seen trying to perform a Fraggle attack, a type of DDoS attack where the attacker sends a large amount of UDP traffic to a router's broadcast network.

A dangerous data surveillance spyware was tied back to this IP.

Excessive Form Submission Attempts: Numerous form submission attempts within a short time, signifying brute-force or captcha bypass attempts.

The IP attempted to login to the Postfix server with an invalid username.

This IP belongs to Exelon.

A large number of requests from a single user agent, suggesting an automated process.

This IP belongs to Liberty Mutual Insurance Group.

The IP attempted to perform a SIP Invite Flood on the SIP server.

It attempted to perform a brute force attack on the POP3 server.

Forceful Browsing: Attempts to access pages or resources without proper navigation.

Multiple requests with identical Accept-Charset headers.

The identified IP address was involved in planting backdoor programs that give excessive control over infected systems.

This IP belongs to Shaw Communications.

The IP attempted to perform a Multicast DNS amplification attack on the SSH server.

The IP attempted to delete directories on the SSH server.

It established numerous 'doppelganger' domains to mimic our SSH server, aiming to trick users into revealing sensitive data.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

It appears that this IP was initiating DNSChanger malware attacks on our network.