Unusual patterns of behavior, such as login attempts at regular intervals or sequential patterns in the attempted passwords.

Unusual increase in network bandwidth usage.

The IP showed unusual patterns in session IDs.

It attempted to flood the SIP server with REGISTER requests.

This malicious IP was reported for attempting a Smurf attack, flooding a target system via spoofed broadcast ping messages.

The IP address attempted to login to the IMAP server with an invalid username.

It made multiple requests with the same X-Forwarded-For header.

The IP was involved in a war dialing attack, dialing a large number of phone numbers to find modems, fax machines, and unsecured VoIP devices.

The IP attempted to perform a SNMP amplification attack on the SSH server.

This IP belongs to Kroger.

The IP was reported for attempting a Cross-Site Scripting attack, injecting malicious scripts into websites to steal data or disrupt functionality.

This IP belongs to Philip Morris International.

Repeated attempts to access the server using insecure or deprecated methods.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

The IP was seen trying to perform a SIP Registration Hijacking attack, attempting to impersonate a legitimate user to receive their calls.

The IP attempted to use the FTP server to distribute spam.

The IP engaged in DNS Spoofing, rerouting our server's lookups to a malicious destination.

This IP belongs to MetLife.

The IP made multiple requests with the same Via header.

It made numerous requests to the same endpoint in a short time.

The IP address attempted to exploit known vulnerabilities in server software.

The malicious IP attempted to exploit server misconfigurations to gain higher-level access.

Repeated connections to the server from unknown or suspicious IP addresses.

It attempted to perform Local File Inclusion (LFI) attacks on the Apache server.

This IP belongs to United Technologies.