By launching ApacheKiller attacks, the IP aimed to cause a Denial of Service by exhausting memory resources.

It attempted to delete emails from the IMAP server without authorization.

The IP was seen trying to perform a call transfer to an external number, a potential sign of toll fraud.

The IP attempted to perform a Multicast DNS amplification attack on the SSH server.

The IP attempted to use the Mail server to relay phishing emails to other servers.

This IP belongs to AmerisourceBergen.

The malicious IP was reported for attempting to reroute calls through the SIP server, a tactic often used to commit toll fraud.

This IP belongs to Exxon Mobil.

This IP belongs to PythonAnywhere.

The IP made multiple unsuccessful login attempts to the SASL server in a short period of time.

This IP belongs to Plusnet.

It tried to exploit Apache Struts vulnerabilities to compromise our web applications.

GET /vuln.html: Looking for any page vulnerabilities.

The IP engaged in DNS Spoofing, rerouting our server's lookups to a malicious destination.

This IP was found responsible for a session hijacking attempt on our network.

Distributed session hijackers from the IP were designed to capture and exploit web browser sessions.

Signs of CSRF Attacks: Logs demonstrating HTTP GET requests with sensitive actions that should ideally require POST requests.

This IP belongs to Freddie Mac.

This particular IP attempted to exploit vulnerabilities in our web applications.

The IP sent numerous SIP OPTIONS requests in a short time.

Repeated attempts to perform actions that are typically restricted, such as creating or modifying user accounts.

Multiple requests with the same X-Csrf-Token header.

It attempted to perform a SIP Invite Flood on the VOIP server.

The IP was seen launching a DDoS attack on the FTP server, overwhelming it with traffic to disrupt its normal functioning.

It sent VOIP requests to non-existent extensions.