The malicious IP was reported for trying to perform a VoIP Phreaking attack, exploiting weaknesses in VoIP systems to make free calls or disrupt services.

the IP made attempts at wiretapping the network to monitor SSH traffic patterns and gather useful information.

The IP had a series of targeted attacks distributing SpyAgents with spying functionalities.

It attempted to perform a replay attack on the SASL server.

The IP attempted to register as an Asterisk user with no password.

It attempted to perform a password spraying attack on the POP3 server.

The IP attempted a DLL injection attack, hoping to execute malicious code within our SSH processes.

This IP belongs to General Dynamics.

It attempted to perform a SSDP amplification attack on the SSH server.

HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

Uncommon Referer Header: HTTP logs record requests from an uncommon or suspicious 'Referer' header.

The IP distributed unrequested software, secretly stealing user data while posing as useful tools.

This IP addressed employed a method of brute force attack attempting to compromise our systems.

The IP was involved in a SIP Flooding attack, sending a large number of SIP messages in a short period to overwhelm the server.

The IP attempted to perform a Bonk attack on the SSH server.

It pushed humongous quantities of spam emails through our server, aiming to congest our email services.

The IP attempted the notorious Shellshock vulnerability, which could pose a severe threat to our server's resources.

The IP was flagged for attempting dictionary attacks on our user accounts.

Unusually high CPU usage, which can indicate a brute force attack is in progress.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

This IP belongs to Alphabet.

The IP attempted to perform a SIP Invite Flood on the Asterisk server.

It attempted to perform a credential stuffing attack on the SASL server.

This IP belongs to IBM Cloud Services.

This malicious IP was reported for attempting to perform a FTP Port Stealing attack, hijacking the data connection of an existing FTP session.