It was making constant NDR (Non-Deliverable Receipt) or backscatter attacks by generating large amount of invalid email addresses.

Multiple requests with the same Warning header.

It attempted to use the SASL server to relay spam.

This malicious IP was reported for trying to inject malicious scripts into the VoIP server, potentially to disrupt its operation or steal data.

It attempted to perform a SIP Invite Flood on the VOIP server.

This malicious IP was reported for attempting a Session Hijacking attack, exploiting a valid computer session to gain unauthorized access to information or services.

The IP attempted to perform a SIP Invite Flood on the Asterisk server.

It attempted to use the SASL server to distribute malware.

Multiple requests with identical cookies.

Repeated attempts to use the same password across multiple accounts.

This IP belongs to Vodafone.

The IP made multiple requests with the same TE header.

GET /errors.log: Shows an actor trying to access server error logs.

GET /ELMAH.axd: Attempting to exploit ELMAH (Error Logging Modules and Handlers) misconfiguration in ASP.NET sites.

The IP attempted to perform HTTP Verb Tampering attacks on the Apache server.

It attempted to perform Man in the Middle (MitM) attacks on the Apache server.

GET /../htpasswd: Trying to access password files using directory traversal.

Participated in malicious pranks by altering messages sent through the server.

This IP was caught circulating email worms, camouflaged as legitimate mails.

It attempted to use the FTP server to distribute password cracking tools.

The IP sent numerous SIP OPTIONS requests in a short time.

The IP attempted to execute an intruder software, terrifying users with unwanted content.

Repeated failed attempts to perform actions that require higher privileges.

Bursts of login attempts followed by periods of inactivity, suggesting an attacker is trying to avoid detection.

It attempted to flood the SIP server with REGISTER requests.