Signal of DDoS Attacks: Multiple IP addresses sending a significantly high volume of traffic.

The IP made repeated attempts to authenticate with the Asterisk server using different usernames.

The IP targeted our server with PHP Injection attacks to gain access to sensitive data.

The IP was engaged in email append attacks, trying to add addresses to an existing email or response mid-transit.

The IP attempted to perform a SIPVicious scan on the VOIP server.

Attempts to use default or common usernames and passwords, a common tactic in brute force attacks.

It attempted to use the Asterisk server as a relay for calls to premium-rate numbers.

This IP belongs to TIAA.

It appears this IP was linked to a number of drive-by-download attacks, silently downloading spyware.

The IP attempted a DLL injection attack, hoping to execute malicious code within our SSH processes.

It attempted to carry out a dictionary attack on pop3 logins to gain unauthorized access.

The IP address was found roaming through the network, scanning for weak spots.

Initiated rogue DHCP server set up, attempting to disrupt our network and intercept emails.

This IP belongs to the United States Department of Defense.

The IP was seen launching a DDoS attack on the Asterisk server, overwhelming it with traffic to disrupt its normal functioning.

Suspicious URL Encoding: Seeing HTTP requests with a lot of %, suggesting URL encoding to evade detection.

The IP was involved in a Directory Traversal attack on the FTP server, attempting to access restricted directories and files.

This particular IP tried to perform an unauthorized system configuration change.

GET /manager/html: Signals an attempt to access the Tomcat Application Manager.

It attempted to send emails from the Mail server to a large number of recipients.

This IP belongs to Jabil.

The IP had a series of targeted attacks distributing SpyAgents with spying functionalities.

Bursts of login attempts followed by periods of inactivity, suggesting an attacker is trying to avoid detection.

The IP sent numerous VOIP OPTIONS requests in a short time.

We identified the IP address as a source of numerous scare tactics spyware.