The IP was seen trying to perform a call transfer to an external number, a potential sign of toll fraud.

It attempted to send phishing emails from the Postfix server.

This IP belongs to Philip Morris International.

It sent SIP INVITE requests to non-existent extensions.

It attempted to login to the SSH server with an invalid password.

This IP belongs to Xbox Live.

It attempted to perform a Teardrop attack on the SSH server.

It attempted to flood the SIP server with REGISTER requests.

It attempted to use the Asterisk server as a relay for calls to premium-rate numbers.

The IP performed Covert Timing Channel attacks, gathering information about encrypted SSH traffic by analyzing packet timing.

This IP belongs to IBM Cloud Services.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

This IP belongs to NTT Docomo.

This IP belongs to Xbox Live.

The IP attempted to execute an intruder software, terrifying users with unwanted content.

Attempts to access the server using credentials that have been involved in previous security incidents.

The IP was involved in a rapid sequence of login attempts.

This IP was reported for attempting to register a large number of SIP extensions in a short time, a sign of a potential brute force attack.

GET /admin: Looking for an unprotected admin page.

The IP made multiple unsuccessful login attempts to the SSH server in a short period of time.

The IP attempted to send spam emails from the Postfix server.

This IP belongs to 3M.

The said IP was the source of several rootkit deployment attempts.

The IP was noticed spreading RATs (remote administration tools) camouflaged as regular software.

The IP made multiple requests to the server's robots.txt file.