Remote Execution Attempts: Logs showing unusual terminal commands or scripts run through web access.

It attempted to exploit known vulnerabilities in the POP3 protocol.

It attempted to use the VOIP server as a relay for calls to premium-rate numbers.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

The IP was involved in a RTP Bleeding attack, exploiting vulnerabilities in the VoIP server to listen to ongoing calls.

This IP belongs to General Electric.

Unusual patterns in user agent strings.

This IP belongs to AmerisourceBergen.

The IP attempted to register as a SIP user with no password.

This IP belongs to CenturyLink.

This IP belongs to Walgreens Boots Alliance.

Multiple requests with the same If-Range header.

This IP belongs to United Technologies.

Multiple Sequential Page Requests: Quick, sequential requests to all pages of a site could be someone scanning for vulnerabilities.

It sent unusually large SIP packets, potentially indicating a buffer overflow attempt.

It tried to use the email server for bounce spam, of sending out spam to third parties with forged return paths.

A series of active scareware campaigns was traced back to this IP address.

This IP belongs to Microsoft.

It attempted to make unauthorized calls using the Asterisk server.

It attempted to perform Race Condition attacks on the Apache server.

The IP sent numerous VOIP OPTIONS requests in a short time.

Multiple attempts to access the server using encrypted tunnels or proxies.

This malicious IP was reported for trying to perform a Symlink attack, creating symbolic links to files outside the FTP server's root directory.

Unusual command line activities that are not typical for the server environment.

It attempted to perform a SIP Invite Flood on the VOIP server.