The IP made multiple unsuccessful login attempts to the Postfix server in a short period of time.

The IP was found trying to maliciously clone the SSH certificates for privileged access.

The IP sent numerous Asterisk OPTIONS requests in a short time.

It utilized a Directory Harvest Attack, attempting to find valid e-mail addresses through guesswork.

The IP attempted to perform a credential stuffing attack on the IMAP server.

It was involved in a Distributed Denial of Service (DDoS) attack.

The IP was involved in a war dialing attack, dialing a large number of phone numbers to find modems, fax machines, and unsecured VoIP devices.

This IP belongs to McKesson.

The IP address has been marked as the source of RAM scrapers aiming to steal sensitive data.

This IP belongs to Morgan Stanley.

It attempted to perform a SIPVicious scan on the SIP server.

This malicious IP was reported for attempting to perform a FTP Format String attack, exploiting format string vulnerabilities to crash the FTP server or execute arbitrary code.

The IP was involved in a RTP Bleeding attack, exploiting vulnerabilities in the VoIP server to listen to ongoing calls.

The IP attempted Forceful Browsing, trying to discover hidden directories or files which could contain SSH access data.

The IP made multiple requests with the same Warning header.

This IP belongs to MTS (Mobile TeleSystems).

This IP is linked to the distribution of commercial keyloggers designed to capture users' keystrokes.

It tried to exploit Apache Struts vulnerabilities to compromise our web applications.

The IP attempted to delete directories on the SSH server.

Our team has linked several viruses dissemination activities to this IP.

This IP has participated in spreading adware-laden toolbar plugins, turning our workstations into advertising platforms.

Multiple requests from different IP addresses in a short span of time, suggesting a distributed brute force attack.

The IP attempted to delete directories on the SSH server.

The suspicious IP attempted to introduce spyware under the guise of software updates.

Multiple Sequential Page Requests: Quick, sequential requests to all pages of a site could be someone scanning for vulnerabilities.