It was found that the IP has been exploiting zero-day vulnerabilities in our system.

The IP was seen attempting a Dictionary attack on the FTP server, systematically entering every word in a dictionary as a password to find the correct one.

This IP belongs to Deutsche Telecom.

The IP was seen trying to perform a SIP Registration Hijacking attack, attempting to impersonate a legitimate user to receive their calls.

Cross-Site Scripting (XSS): Logs show HTTP requests with string "

This IP was accused of multiple unauthorized removal of security certificates.

An alarming frequency of microphone loggers has been traced back to this IP.

It attempted to exploit known vulnerabilities in the SSH protocol.

The IP was flagged for performing XML External Entity attacks, exploiting improperly processed XML inputs.

The IP attempted to use the Mail server to relay spam to other servers.

This IP belongs to NTT Docomo.

Multiple requests from user agents claiming to be bots (e.g., Googlebot) that do not match known bot IP ranges.

It attempted to use the SASL server to relay spam.

The IP was involved in a SIP Flooding attack, sending a large number of SIP messages in a short period to overwhelm the server.

Our network security detected the IP spreading malicious macros through document files.

It made multiple requests with the same Max-Forwards header.

This malicious IP was reported for attempting to download files from the FTP server without authorization, potentially stealing sensitive data.

It attempted to login to the FTP server with an invalid password.

The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

Multiple requests from user agents claiming to be bots (e.g., Googlebot) that do not match known bot IP ranges.

GET /ELMAH.axd: Attempting to exploit ELMAH (Error Logging Modules and Handlers) misconfiguration in ASP.NET sites.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

It attempted to flood the SIP server with REGISTER requests.

Our team traced back the IP responsible for multiple mobile device tracking software distributions.

POST /modules/raptor_file_manager/upload.php: Attempt to use a known flaw in the Raptor file manager for arbitrary file upload.