The IP was seen trying to perform a SIP Registration Hijacking attack, attempting to impersonate a legitimate user to receive their calls.

It attempted to send emails from the Mail server that violate the server's acceptable use policy.

The IP attempted to perform a SIPVicious scan on the VOIP server.

This IP belongs to Boeing.

It was making constant NDR (Non-Deliverable Receipt) or backscatter attacks by generating large amount of invalid email addresses.

The malicious IP was reported for sending a high volume of SIP INVITE requests, a potential sign of a call flooding attack.

The IP address attempted to exploit known vulnerabilities in server software.

It was noticed that the IP has tried illegal attempts of reverse engineering our software.

Multiple login attempts from different geographical locations in a short period of time.

Multiple account lockouts in a short period of time.

This IP belongs to Dow Chemical.

The IP attempted to use the POP3 server to distribute malware.

The IP attempted to execute an intruder software, terrifying users with unwanted content.

Unusual Query String Patterns: Repeated HTTP requests with minor alterations to the query string data, signifying an attacker mapping out how different inputs affect the response.

GET /errors.log: Shows an actor trying to access server error logs.

Multiple requests with the same If-None-Match header.

This IP belongs to Amazon.

The IP attempted to use the Mail server to relay spam to other servers.

The IP address has been involved in distributing adware to our server systems.

This IP belongs to T-Mobile.

This IP was detected initiating zero-day exploit attacks on our system.

This IP belongs to United Technologies.

Malicious Script Execution: Execution attempts of suspicious scripts or encoded payloads often seen in URI parameters or request bodies.

The IP address attempted to login to the SSH server with an invalid username.

It was caught injecting malicious code into the SSH session attempting to compromise server integrity.