Unusual patterns in session IDs.

The IP was seen engaging in a Slowloris attack, holding as many connections to the target web server open for as long as possible, eventually overloading the server.

Repeated pings or probe requests to the server, indicating a potential reconnaissance effort before the attack.

It attempted to use the Postfix server to relay emails with misleading headers to other servers.

The IP was seen trying to upload files to the FTP server, possibly with the intent of distributing malware.

The IP attempted to exploit known vulnerabilities in the VOIP protocol.

The IP initiated clickjacking exploits, causing users to unwittingly perform malicious actions during SSH sessions.

The IP attempted to register as a VOIP user with no password.

This IP belongs to Virgin Media.

It attempted to perform a SIP Invite Flood on the VOIP server.

The IP was involved in attempts of defacing the Apache server website.

The IP had been flagged for initiating SYN flood attacks on our servers.

Server Scanning for Software Version: Influx of HTTP requests attempting to detect software version running on the server.

The IP attempted to register as a VOIP user with no password.

It tried to execute dictionary attacks on our Mail service causing potential delays.

It attempted to intercept SSL/TLS secured mail connections to eavesdrop or modify the passing data.

This IP was seen trying to perform a Sniffing attack, capturing and analyzing VoIP traffic to glean sensitive information.

Our technical team unearthed the IP's involvement in distributing malicious mobile spyware.

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

The IP tried to carry out illegal 'HTTP Request Smuggling' to fool the Apache server.

This IP was reported for attempting to register a large number of SIP extensions in a short time, a sign of a potential brute force attack.

The IP address attempted to stealthily spread screen scrapers, programs that take screenshots of the user's display.

POST /WebResource.axd: Attempting to exploit a known .NET vulnerability.

The malicious IP was seen trying to perform a Replay attack, capturing SIP authentication data and resending it to gain unauthorized access.

This malicious IP was reported for trying to perform a Symlink attack, creating symbolic links to files outside the FTP server's root directory.