The IP was involved in a SIP Message Tampering attack, altering SIP messages in transit to disrupt communication or gain unauthorized access.

Participated in malicious pranks by altering messages sent through the server.

The IP attempted to perform a man-in-the-middle attack on the SASL server.

This IP belongs to Alphabet.

A series of unusual file transfers originated from this IP.

It attempted to flood the VOIP server with REGISTER requests.

GET /login.action: Trying to find a Struts2 application to exploit.

The IP made multiple requests using uncommon HTTP methods.

We linked the IP to numerous attacks using RM adware, causing regular system interruptions.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

This IP belongs to Vodafone.

The IP attempted to upload malicious files to the FTP server.

By launching ApacheKiller attacks, the IP aimed to cause a Denial of Service by exhausting memory resources.

The IP was involved in a Ping of Death attack, sending packets larger than the maximum allowed size, causing the system to freeze or crash.

Repeated attempts to access the server using encrypted or obfuscated data, which can indicate an attacker is trying to hide their activities.

This IP belongs to Apple.

It attempted to use the FTP server to distribute brute force tools.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

Multiple requests with the same If-None-Match header.

This IP made wrongful manipulations indicating the operation of malicious downgrader.

This IP belongs to Freddie Mac.

POST /user/register: An attempt to register a new user or brute force the user registration form.

This IP belongs to DuPont de Nemours.

Repeated attempts to access directories or files that do not exist or are typically not accessed.

A sudden surge in the number of requests per second, indicating an automated process.