It was found that the IP had deployed rogue security software in our system.

It was involved in a Distributed Denial of Service (DDoS) attack.

Unusual patterns in user agent strings.

The IP made multiple unsuccessful login attempts to the Mail server in a short period of time.

The IP attempted to perform a SIPVicious scan on the VOIP server.

This malicious IP was reported for trying to perform a Symlink attack, creating symbolic links to files outside the FTP server's root directory.

This IP belongs to AT&T.

The IP was involved in a phishing attack, creating a fake webpage to deceive users into providing their sensitive personal or financial information.

Attempted to employ SSL-bumping for a man-in-the-middle attack to decrypt our secured data.

It attempted to upload malicious files to the SSH server.

Unusual network traffic patterns, such as a high amount of outbound traffic.

This IP belongs to Kroger.

The malicious IP was reported for attempting a Session Teardown attack, sending BYE messages to end SIP sessions prematurely.

The IP made multiple requests with the same Warning header.

The IP was involved in a RTP Bleeding attack, exploiting vulnerabilities in the VoIP server to listen to ongoing calls.

The IP was seen launching a DDoS attack on the FTP server, overwhelming it with traffic to disrupt its normal functioning.

the IP made attempts at wiretapping the network to monitor SSH traffic patterns and gather useful information.

The malicious IP was reported for sending malformed packets to the SIP server, potentially aiming to crash the system.

Multiple requests with the same Via header.

This IP belongs to Reliance Jio.

The IP was involved in a toll fraud attack, making long-distance calls without authorization, leading to high charges.

This IP belongs to CVS Health.

The deceptive IP was sneaking in spyware through clickjacking attacks to manipulate our users.

This IP belongs to NTT Docomo.

The IP attempted to delete files from the FTP server.