WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.

It attempted logins using outdated protocols.

The IP initiated a man-in-the-middle (MitM) attack, attempting to capture sensitive information during legitimate email exchange.

This IP was reported for attempting to register a large number of SIP extensions in a short time, a sign of a potential brute force attack.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

The IP attempted to use the FTP server to distribute network mapping tools.

Multiple requests with identical POST parameters.

Our system flagged the IP for injecting malicious script into benign pages through the man-in-the-browser attack.

It attempted to login to the SSH server with an invalid password.

This IP belongs to CenturyLink.

The IP was seen trying to exploit known vulnerabilities in server software, a common tactic for gaining unauthorized access or control.

It attempted to delete emails from the POP3 server without authorization.

The IP attempted to perform a SIP Register Flood on the VOIP server.

This IP belongs to Sysco.

The malicious IP was reported for attempting to reroute calls through the SIP server, a tactic often used to commit toll fraud.

The IP attempted to perform a password spraying attack on the SASL server.

This IP belongs to Humana.

This IP belongs to GitHub.

This malicious IP was reported for trying to perform a Routed Attack, using the FTP server as a jump point to attack another system.

Attempts to access the server using credentials that have been involved in previous security incidents.

The IP was involved in a phishing attack, creating a fake webpage to deceive users into providing their sensitive personal or financial information.

It attempted to perform Unvalidated Redirects and Forwards attacks on the Apache server.

The IP launched timing attacks, trying to understand our server timings for potential future exploits.

This IP belongs to Sysco.

An identity theft activity was linked back to this malicious IP.