The IP made multiple requests with the same Proxy-Connection header.

It attempted to upload malicious scripts to the Apache server.

It was detected trying to perform cross-site scripting to bypass the same origin policy on Apache.

Multiple failed login attempts using different usernames.

Unusual patterns of behavior, such as login attempts at regular intervals or sequential patterns in the attempted passwords.

Attempts to use automated scripts or tools for password cracking.

The IP made multiple requests with the same Origin header.

The IP tried to perform a cross-site request forgery attack on the IMAP service.

It launched a SYN flood attack, aiming to consume server resources and disrupt services.

It attempted to send emails from the Postfix server to a large number of recipients.

It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

It sent SIP INVITE requests to non-existent extensions.

HTTP Request with Odd Timing: Very precisely timed HTTP requests could imply an automated tool or bot.

This IP belongs to Liberty Mutual Insurance Group.

It attempted to send emails from the Mail server that violate the server's acceptable use policy.

This IP belongs to PythonAnywhere.

This IP belongs to Bank of America.

This IP was reported for attempting to use the SIP server to mask its true location and identity, a common tactic in VoIP phishing attacks.

This IP belongs to MetLife.

The IP was seen trying to perform a Fraggle attack, a type of DDoS attack where the attacker sends a large amount of UDP traffic to a router's broadcast network.

Bursts of login attempts followed by periods of inactivity, suggesting an attacker is trying to avoid detection.

The malicious IP was reported for sending a high volume of SIP INVITE requests, a potential sign of a call flooding attack.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.

It attempted to use the Asterisk server as a relay for calls to premium-rate numbers.

Attempts to access the server using stolen or leaked credentials.