Multiple 5xx Server Error Codes: A high count of server error status codes such as '500 Internal Server Error' may suggest an attacker is probing the server's security.

It sent SIP INVITE requests to non-existent extensions.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

It sent SIP INVITE requests to non-existent extensions.

The IP attempted to bypass IP blacklisting by rapidly changing its IP address.

It attempted to use the SSH server as a proxy for other malicious activities.

It initiated requests to non-existent endpoints.

It attempted to perform a VOIP Hopper scan on the Asterisk server.

It was observed attempting to exploit known vulnerabilities in the IMAP protocol.

This IP belongs to Massachusetts Mutual Life Insurance.

It attempted to send emails with malicious links from the Postfix server.

It systematically tried to exploit IMAP and POP3 vulnerabilities present in our mail service setup.

The said IP was the source of several rootkit deployment attempts.

This IP belongs to Proximus.

The IP was involved in a Directory Traversal attack, attempting to access restricted directories and files.

This IP attempted to disrupt our systems through the propagation of worms.

The IP attempted to send emails from the Mail server without proper authentication.

Remote File Inclusion (RFI): You might see HTTP requests with "=http" or "=ftp" which can signal an attempt for remote file inclusion.

Usage of Obscure HTTP Verbs: Seeing non-standard HTTP methods like DEBUG, PUT, or CONNECT could imply a web-based attack.

This IP belongs to Mondelez International.

The IP attempted to perform HTTP Verb Tampering attacks on the Apache server.

The IP was engaged in port scanning, probing the server for open SSH ports.

Executed email spoofing attempts pretending to be a trusted party.

The IP address attempted to login to the FTP server with an invalid username.

The IP has been implicated in multiple cases of URL manipulation attempts.