Bursts of login attempts followed by periods of inactivity, suggesting an attacker is trying to avoid detection.

It sent VOIP requests to non-existent extensions.

Login Attempts with Automated User-Agents: Logs reflect requests to login page with 'bot' or 'spider' in user-agent strings.

The IP attempted to list the contents of directories that it should not have access to.

It attempted to use the FTP server to distribute pirated software.

The IP launched timing attacks, trying to understand our server timings for potential future exploits.

This IP belongs to The Hartford Financial Services.

The IP made repeated attempts to authenticate with the VOIP server using different usernames.

This IP belongs to Dell Technologies.

The IP was engaged in email append attacks, trying to add addresses to an existing email or response mid-transit.

It exploited insecure server configurations and attempted to establish reverse SSH tunneling.

It tried to force its way into a secure admin session by trying to hijack the session's cookies.

The malicious IP was seen trying to perform a Replay attack, capturing SIP authentication data and resending it to gain unauthorized access.

This IP belongs to Twenty-First Century Fox.

It attempted to perform a RIPv1 amplification attack on the SSH server.

Excessive Form Submission Attempts: Numerous form submission attempts within a short time, signifying brute-force or captcha bypass attempts.

Server Side Request Forgery Attempts: Logs may show HTTP requests attempting to manipulate the server into making unintended requests.

This IP belongs to Fannie Mae.

Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

This IP was seen trying to perform a SIP URI Spoofing attack, falsifying the SIP URI to deceive the receiver or hide the caller's identity.

This IP belongs to Phillips 66.

The IP made repeated attempts to authenticate with the Asterisk server using different usernames.

It attempted to use the POP3 server to relay phishing emails.

The IP attempted to manipulate trusted authorities by conducting SSL strip attacks.

This IP belongs to Publix Super Markets.