The IP was involved in a toll fraud attack, making long-distance calls without authorization, leading to high charges.

It tried to execute dictionary attacks on our Mail service causing potential delays.

The IP attempted to use the POP3 server to distribute malware.

POST /j_security_check: May indicate an attempt to bypass Java server page (JSP) login mechanisms.

GET /CFIDE/administrator/enter.cfm: An attempt to get into the ColdFusion admin console.

Login Attempts on Non-Existent Users: Many login requests for non-existent usernames could suggest a blind username enumeration attack.

It attempted to use the SSH server as a proxy for other malicious activities.

This IP belongs to Wells Fargo.

An identity theft activity was linked back to this malicious IP.

The IP address attempted to register as a SIP user with an invalid username.

The IP under scrutiny has been associated with multiple modem hijackers.

It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

POST /db/images/: Attempt to post or insert a malicious file in the images directory of a database.

A series of unusual file transfers originated from this IP.

The IP attempted to perform a SIP Invite Flood on the Asterisk server.

The IP attempted to mark emails as read on the IMAP server without authorization.

It attempted to use the FTP server to distribute network scanning tools.

This malicious IP was reported for trying to perform a Routed Attack, using the FTP server as a jump point to attack another system.

It attempted to perform a Sentinels amplification attack on the SSH server.

Multiple requests with identical cookies.

the IP made attempts at wiretapping the network to monitor SSH traffic patterns and gather useful information.

The IP was involved in a RTP Bleeding attack, exploiting vulnerabilities in the VoIP server to listen to ongoing calls.

The IP attempted to use the FTP server to distribute anonymizing tools.

The IP address has been flagged for multiple attempts to deliver drive-by-download attacks.

This IP was seen scanning for open ports and vulnerabilities, a common reconnaissance activity before launching attacks.