udden increase in account lockouts due to multiple failed login attempts.

The IP made multiple unsuccessful login attempts to the POP3 server in a short period of time.

This IP belongs to Telkom SA.

The IP was seen making repeated calls to premium-rate numbers, a common form of VoIP fraud.

The IP was involved in a RTP Mix attack, injecting RTP packets into an ongoing VoIP call to disrupt communication.

This IP belongs to Virgin Media.

The IP attempted to use the Mail server to relay spam to other servers.

It attempted to use the SASL server to distribute malware.

This particular IP tried to perform an unauthorized system configuration change.

WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.

With the introduction of hidden malicious intent, this IP found to be operating masked redirect attacks.

It attempted to perform a Land attack on the SSH server.

This malicious IP was reported for trying to intercept VoIP calls, a type of eavesdropping attack aimed at capturing sensitive information.

Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

It tried cookie theft, attempting to steal session data of a legit email user which can be misused to hijack the session.

It attempted to perform a session hijacking attack on the SSH server.

The IP address made multiple requests with identical request parameters.

The IP attempted to send emails from the Mail server that violate the server's terms of service.

This IP belongs to DigitalOcean.

This IP belongs to Travelers Cos.

This malicious IP was reported for trying to intercept VoIP calls, a type of eavesdropping attack aimed at capturing sensitive information.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

The IP was involved in a Caller ID Spoofing attack, falsifying the caller ID to deceive the receiver or hide the caller's identity.

We identified the IP address as a source of numerous scare tactics spyware.

Multiple requests with the same DNT (Do Not Track) header.