It sent unusually large VOIP packets, potentially indicating a buffer overflow attempt.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.

The IP attempted to perform Format String attacks on the Apache server.

Multiple attempts to access the server using anonymous or generic user accounts.

This IP belongs to Ford Motor.

The IP attempted to perform a phishing attack using the SASL server.

It attempted to list the contents of directories that it should not have access to.

GET /internal/: Browsing an internal directory.

This IP was implicated in attempts to inject ransomware into our systems.

It attempted to perform Server Side Request Forgery (SSRF) attacks on the Apache server.

Our team has linked several viruses dissemination activities to this IP.

This IP belongs to GoDaddy.

A series of unusual file transfers originated from this IP.

The IP attempted to perform a Fraggle attack on the SSH server.

This IP belongs to Costco Wholesale.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.

The IP made repeated attempts to authenticate with the SIP server using different usernames.

This IP belongs to Travelers Cos.

It attempted to use the FTP server to distribute network scanning tools.

It made multiple attempts to initiate malicious File Transfer Protocol (FTP) sessions with the Postfix service.

It launched a botnet to infiltrate our Apache-DDoS service.

This IP belongs to Northwestern Mutual.

Unknown source code changes in our system were linked back to this offensive IP address.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.