This IP was seen trying to perform a RTP Injection attack, inserting audio into an established VoIP call.

The IP attempted to bypass IP blacklisting by rapidly changing its IP address.

This malicious IP was reported for trying to perform a Routed Attack, using the FTP server as a jump point to attack another system.

Attempts to use default or common usernames and passwords, a common tactic in brute force attacks.

The IP address attempted to login to the SSH server with an invalid username.

POST /WebResource.axd: Attempting to exploit a known .NET vulnerability.

This IP belongs to PepsiCo.

Multiple requests with identical Accept-Encoding headers.

The IP launched exploitation attacks based on the infamous 'Heartbleed' OpenSSL cryptographic vulnerabilities.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

This IP was reported for attempting to use the SIP server to mask its true location and identity, a common tactic in VoIP phishing attacks.

The IP was seen traffic sniffing, trying to spy on and analyse network packets for potential server vulnerabilities.

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

The IP tried launching Server Query Flooding to overwhelm our server with requests.

This IP belongs to Verizon.

It attempted to use the SASL server to relay spam.

This IP belongs to Netflix.

The IP initiated SYN flooding attacks, aiming to disrupt service by overwhelming the server.

This IP belongs to Citigroup.

The IP attempted to send malware-infected attachments from the Mail server.

It repetitively attempted Port Scanning to identify open ports and related vulnerabilities.

The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

The IP was involved in distributing malware, infecting systems or networks to steal data, cause damage, or gain unauthorized access.

Multiple Sequential Page Requests: Quick, sequential requests to all pages of a site could be someone scanning for vulnerabilities.