The IP attempted to perform a SIP Register Flood on the VOIP server.

The IP attempted to list the contents of directories that it should not have access to.

Multiple requests with the same X-Requested-With header.

POST /user/register: An attempt to register a new user or brute force the user registration form.

This IP belongs to Walmart.

Our network security detected the IP spreading malicious macros through document files.

It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

The IP attempted to register with the VOIP server using an invalid username.

Unusual patterns of behavior, such as login attempts at regular intervals or sequential patterns in the attempted passwords.

The IP showed unusual patterns in referrer URLs.

The IP was part of an IRC-Bot network, a type of botnet that uses the Internet Relay Chat (IRC) protocol.

The IP attempted to perform a SNMP amplification attack on the SSH server.

Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

It attempted to use the FTP server to distribute password recovery tools.

This malicious IP was reported for attempting a Sniffing attack, capturing and analyzing FTP traffic to glean sensitive information.

Code Injection: Usage of standard codes (like Base64) to obscure attack payloads or commands.

It attempted to perform Local File Inclusion (LFI) attacks on the Apache server.

Our team flagged this IP for injecting harmful ActiveX codes.

Suspicious URL Encoding: Seeing HTTP requests with a lot of %, suggesting URL encoding to evade detection.

The IP launched timing attacks, trying to understand our server timings for potential future exploits.

It sent unusually large SIP packets, potentially indicating a buffer overflow attempt.

Executed numerous SQL injection attacks in an attempt to manipulate the server's databases.

This IP belongs to Morgan Stanley.

It tried to execute Privilege Escalation attacks, trying to gain higher-level access on our server.