The IP's involvement in spreading password stealers has compromised our network's protection.

The IP was flagged trying to conduct Denial of Service (DoS) attacks on the Postfix service.

The IP attempted to use the Mail server to relay spam to other servers.

This IP was reported for attempting a Dictionary attack on the VoIP server, systematically entering every word in a dictionary as a password to find the correct one.

Our data revealed this IP distributing malicious powershell scripts.

The IP was involved in a VoIP Hopping attack, jumping from one VoIP network to another to avoid detection or gain unauthorized access.

Unknown IP Address: An unfamiliar IP address making frequent requests could imply a compromised machine.

The IP attempted to perform Man in the Browser (MitB) attacks on the Apache server.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.

The IP attempted to register as a VOIP user with no password.

It attempted to use the Postfix server to relay emails with malicious links to other servers.

GET /modules/productpageadverts/uploadimage.php: This is related to a known vulnerability in the Prestashop module productpageadverts.

It partook in whaling attacks, specifically targeting high-profile users within our system.

This IP belongs to Cardinal Health.

It showed unusual activity in the server's error logs.

Side Channel Attacks: Repeated requests aimed at inferring sensitive information through observation of web responses.

Bogus pop-ups irritating our end-users were found to be released by this infamous IP.

The IP initiated a 'Deauth' attack, knocking legitimate users off the Apache service.

This IP was accused of multiple unauthorized removal of security certificates.

Repeated requests for the same file or page, indicating an attempt to crack a password or exploit a vulnerability.

This malicious IP was reported for trying to intercept VoIP calls, a type of eavesdropping attack aimed at capturing sensitive information.

Multiple login attempts using common or easily guessable passwords (like 'password123', 'admin', etc.).

The IP made multiple requests with the same Proxy-Connection header.

The IP attempted logins at unusual times.

It attempted to perform a NTP amplification attack on the SSH server.