Unusual system or application errors related to authentication or access controls.

The IP attempted to perform a password spraying attack on the SASL server.

The IP was seen trying to perform a TDoS (Telephony Denial of Service) attack, flooding the VoIP server with calls to make it unavailable to users.

This IP belongs to Cisco Systems.

The IP address was found roaming through the network, scanning for weak spots.

The IP was involved in a war dialing attack, dialing a large number of phone numbers to find modems, fax machines, and unsecured VoIP devices.

The IP attempted to perform a Nestea attack on the SSH server.

The IP was seen trying to perform a PASV FTP Bounce attack, misusing the passive mode to scan other hosts and ports.

It sent VOIP requests to non-existent extensions.

The IP was marked trying to carry out Backscatter spam by replying to spam using the server's configuration.

This IP attempted to disrupt our systems through the propagation of worms.

The IP was involved in an Email Spoofing attack, sending emails with a forged sender address, often used in phishing and spam campaigns.

This IP belongs to Walmart.

It attempted to perform a SIPVicious scan on the SIP server.

Multiple Sequential Page Requests: Quick, sequential requests to all pages of a site could be someone scanning for vulnerabilities.

The IP attempted to perform a SIP Invite Flood on the Asterisk server.

It attempted to use the Asterisk server as a relay for calls to premium-rate numbers.

This IP address from an unusual location has successfully installed malware on our servers.

It sent unusually large SIP packets, potentially indicating a buffer overflow attempt.

The IP made multiple requests with the same If-Match header.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

It engaged in a click fraud operation using our server’s communication channels.

The IP address was found roaming through the network, scanning for weak spots.

The IP made multiple requests to the server's robots.txt file.

The IP has initiated several exploits, specifically for software vulnerabilities.