The IP attempted to perform a SIP Register Flood on the VOIP server.

The IP was seen trying to perform a TDoS (Telephony Denial of Service) attack, flooding the VoIP server with calls to make it unavailable to users.

The IP tried creating false server responses hoping to disrupt the SASL service.

This IP belongs to CVS Health.

It made multiple requests with the same Max-Forwards header.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

The IP attempted to exploit known vulnerabilities in the VOIP protocol.

The IP was seen trying to upload files to the FTP server, possibly with the intent of distributing malware.

It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

This IP belongs to Dell Technologies.

The IP attempted reconnaissance activities, trying to footprint our server’s network.

This IP belongs to Vodacom.

The IP was seen engaging in a Slowloris attack, holding as many connections to the target web server open for as long as possible, eventually overloading the server.

This IP had been flagged for attempting to manipulate server behaviour by injecting shellcodes.

The malicious IP was involved in a vishing attack, using the VoIP server to deceive users into revealing sensitive information.

This IP attempted to distribute malicious Javascript files.

The IP made multiple requests using uncommon HTTP methods.

The IP made multiple requests to the password reset page.

Multiple attempts to access the server using different ports or protocols.

Multiple Sequential Page Requests: Quick, sequential requests to all pages of a site could be someone scanning for vulnerabilities.

This IP belongs to General Motors.

Rapid sequence of login attempts.

The IP was involved in a RTP Bleeding attack, exploiting vulnerabilities in the VoIP server to listen to ongoing calls.

A series of unusual file transfers originated from this IP.

The IP was found to be behind numerous fileless malware attacks.