The IP was involved in a SIP brute force attack, attempting to guess SIP authentication credentials to gain unauthorized access.

High Frequency POST Requests: Numerous or unusual POST requests in a short time span could indicate a dictionary or brute force attack on a login page.

Unknown source code changes in our system were linked back to this offensive IP address.

This IP was reported for attempting to register a large number of SIP extensions in a short time, a sign of a potential brute force attack.

DNS changer spyware originating from the flagged IP was designed to redirect our network traffic.

The IP attempted to perform a dictionary attack on the POP3 server.

Finally, the IP was caught in the act of Abandoned Object attacks, creating objects with no reference to exhaust memory space

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

Multiple 5xx Server Error Codes: A high count of server error status codes such as '500 Internal Server Error' may suggest an attacker is probing the server's security.

The IP attempted to login to the SASL server with an invalid username.

Attempts to login using a sequential list of passwords, indicating a possible brute force attack.

This IP belongs to Fannie Mae.

Attempts to access the server using known malicious IP addresses or domains.

This IP belongs to Johnson & Johnson.

It was found initiating attack vectors to exploit SSH agent forwarding.

This malicious IP was reported for attempting a FTP Spoof attack, falsifying its IP address to bypass IP-based access controls on the FTP server.

It appears this IP was linked to a number of drive-by-download attacks, silently downloading spyware.

This IP belongs to United Technologies.

This IP belongs to Microsoft.

Unusual patterns in the Accept-Language header.

This IP was seen trying to perform a RTP Injection attack, inserting audio into an established VoIP call.

Multiple login attempts with slight variations in the password, suggesting a dictionary attack, a type of brute force attack.

The malicious IP was reported for attempting a SIP Proxy attack, using a SIP server to mask its true location and identity.

It attempted to exploit known vulnerabilities in the POP3 protocol.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.