It attempted to perform a SIP Brute Force attack on the SIP, VOIP, or Asterisk server.

This IP belongs to Liberty Mutual Insurance Group.

It persistently tried to exploit weaknesses in the SSH communication encryption.

The IP attempted to exploit known vulnerabilities in the SIP protocol.

Repeated attempts to alter or delete log files to cover tracks.

This IP belongs to Citigroup.

Multiple requests with the same X-UIDH header.

It attempted to send emails with deceptive subject lines from the Postfix server.

It attempted to use the Postfix server to relay emails with malicious links to other servers.

This IP belongs to Deutsche Telekom AG.

The IP attempted to perform Session Hijacking attacks on the Apache server.

This IP attacs an FritzBox.

It launched SQL injection attempts, to break our server database through poorly secured entry fields.

HEAD /: May be part of a larger Reconnaissance.

It showed an unusually high number of requests to the login page.

Unwanted Web Crawler Activity: Observing unusual frequent requests from a known web crawler not granted to scan your site.

It's observed that the IP operated a series of attacks exploiting insecure direct object references.

This IP belongs to Phillips 66.

The IP attempted to change file permissions on the SSH server.

We linked several cryptojacking attempts, aimed at harnessing our system resources, to this IP.

Unusual User-Agent: Logs show requests with abnormal, uncommon or non-standard User-Agent strings.

The IP attempted to use the Mail server to relay emails with misleading headers to other servers.

The IP was seen trying to perform a call transfer to an external number, a potential sign of toll fraud.

This IP belongs to Alphabet.

The IP was seen traffic sniffing, trying to spy on and analyse network packets for potential server vulnerabilities.