The IP was reported for hosting a phishing website, deceiving users into providing their sensitive personal or financial information.

Cross-Site Scripting (XSS): Logs show HTTP requests with string "

This IP was seen trying to perform a SIP URI Spoofing attack, falsifying the SIP URI to deceive the receiver or hide the caller's identity.

This IP belongs to Bank of America.

The IP tried launching Server Query Flooding to overwhelm our server with requests.

By leveraging the AgeTunnel software, the IP attempted to establish a covert channel across the SSH session.

This IP belongs to Walmart.

This malicious IP was reported for attempting a FTP Spoof attack, falsifying its IP address to bypass IP-based access controls on the FTP server.

This IP was involved in a Remote File Inclusion (RFI) attack, exploiting a vulnerability to execute malicious scripts from a remote server.

The IP attempted to perform Man in the Browser (MitB) attacks on the Apache server.

The IP address was flagged for employing a packet sniffer on our network.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

It attempted logins using outdated protocols.

It was identified as a BadBot, a type of bot that performs malicious activities.

Executed numerous SQL injection attacks in an attempt to manipulate the server's databases.

Malicious Script Execution: Execution attempts of suspicious scripts or encoded payloads often seen in URI parameters or request bodies.

The IP was seen trying to exploit known vulnerabilities in the Asterisk server, a common tactic for gaining unauthorized access or control.

This IP belongs to MTN.

The malicious IP was reported for attempting a SIP Proxy attack, using a SIP server to mask its true location and identity.

Print Requests Repeatedly: Logs illustrate HTTP requests with "?print" parameter multiple times, indicating someone trying to expose sensitive information.

The IP tried to exploit buffer overflow vulnerabilities to run unauthorized code.

This IP belongs to Home Depot.

The malicious IP was reported for attempting a Session Teardown attack, sending BYE messages to end SIP sessions prematurely.

Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.

The said IP has been connected to attempts to distribute malicious shopping apps.