It was discovered illicitly scanning the server for potential vulnerabilities.

It sent VOIP requests to non-existent extensions.

It sent SIP INVITE requests to non-existent extensions.

Multiple requests using HTTP methods that are not typically used (e.g., TRACE).

This IP was seen trying to perform a Sniffing attack, capturing and analyzing VoIP traffic to glean sensitive information.

It attempted to make unauthorized calls using the VOIP server.

The IP attempted to perform Security Misconfiguration attacks on the Apache server.

The IP attempted to launch Ciphertext attacks, trying to decrypt SSH-encrypted communication.

It made multiple requests with the same If-None-Match header.

The IP attempted to perform a credential stuffing attack on the POP3 server.

This IP belongs to 3M.

Signal of DDoS Attacks: Multiple IP addresses sending a significantly high volume of traffic.

Automated Bot Traffic: Logs are showing an unusual large amount of traffic from known or suspected bot IPs.

Code Injection: Usage of standard codes (like Base64) to obscure attack payloads or commands.

Multiple login attempts using common or easily guessable passwords (like 'password123', 'admin', etc.).

The IP address was identified sending packets with malicious payloads to our server, trying to exploit potential security holes.

The IP was seen trying to perform a TDoS (Telephony Denial of Service) attack, flooding the VoIP server with calls to make it unavailable to users.

The IP was actively engaged in spear-phishing attacks, aimed at high-ranking officials within our network.

This IP has been marked as the origin of numerous SQL injection attacks.

It attempted to perform Race Condition attacks on the Apache server.

Unusually high CPU usage, which can indicate a brute force attack is in progress.

This IP belongs to Sprint.

It attempted to flood the SIP server with REGISTER requests.

This IP belongs to The Hartford Financial Services.

This IP belongs to Apple.