This IP belongs to SK Broadband.

It attempted to perform a SIP Register Flood on the SIP server.

This IP belongs to Freddie Mac.

This IP is linked to the distribution of commercial keyloggers designed to capture users' keystrokes.

It attempted to use a TearDrop attack to corrupt data packets being sent to our server.

The IP attempted to perform a credential stuffing attack on the POP3 server.

This IP belongs to Johnson & Johnson.

It performed botnet operations, controlling a group of “zombie” computers to amplify its DDoS attacks.

An alarming frequency of microphone loggers has been traced back to this IP.

Unusual TCP/IP Headers: Logs reflect HTTP requests with unusual or altered TCP/IP headers, an attempt to confuse or slip through security measures.

The malicious IP attempted to gain unauthorized access to the server by repeatedly trying different username and password combinations.

The IP attempted to exploit known vulnerabilities in the Asterisk protocol.

It attempted to perform Man in the Middle (MitM) attacks on the Apache server.

This IP belongs to IBM.

Incidents of privacy-invasive software floating in our network were linked to this IP.

Repeated HTTP requests with error codes, indicating failed attempts to access restricted areas.

It sent SIP INVITE requests to non-existent extensions.

GET /CFIDE/administrator/enter.cfm: An attempt to get into the ColdFusion admin console.

Repeated attempts to access the server using insecure or deprecated methods.

This IP belongs to NTT Docomo.

GET /trace.axd: An attempt to find a debug handler in ASP.NET.

It attempted to make unauthorized calls using the VOIP server.

GET /muieblackcat: This is often a precursor for additional scanning and likely attacks.

This IP belongs to Microsoft Azure.

Signal of DDoS Attacks: Multiple IP addresses sending a significantly high volume of traffic.