The IP was involved in a RTP Mix attack, injecting RTP packets into an ongoing VoIP call to disrupt communication.

Multiple attempts to access the server using encrypted tunnels or proxies.

Multiple login attempts using common or easily guessable passwords (like 'password123', 'admin', etc.).

POST /WebResource.axd: Attempting to exploit a known .NET vulnerability.

Web shell Upload: Logs may show successful POST requests to server upload functionality, indicating an attempt to upload a malicious web shell.

This IP belongs to Berkshire Hathaway.

This IP was reported for attempting a Dictionary attack on the VoIP server, systematically entering every word in a dictionary as a password to find the correct one.

Attempted to conduct numerous data harvesting strategies to gather sensitive user data.

It attempted to login to the FTP server with an invalid password.

Unusual Port Numbers: HTTP requests to unusual port numbers could be a sign of someone probing for an open, vulnerable port.

Multiple HTTP 401 Status Codes: This could indicate someone is repeatedly attempting to access resources that require valid credentials, possibly attempting to brute-force their way in.

This malicious IP was reported for attempting to perform a FTP Phishing attack, creating a fake FTP login page to deceive users into providing their credentials.

It showed unusual patterns in the sequence of requests.

Unauthorized Access Attempts to Admin Directories: Repeated HTTP requests to known admin directories.

The IP attempted to send emails from the Mail server without proper authentication.

Unusual patterns in the Accept-Language header.

This IP belongs to Hong Kong Broadband Network.

GET /modules/productpageadverts/uploadimage.php: This is related to a known vulnerability in the Prestashop module productpageadverts.

It attempted mail bombing, trying to overwhelm our mail server with high volumes of email.

The malicious IP initiated unauthorized Mail Queue access attempts, impacting mail service efficiency.

This IP was involved in a Remote File Inclusion (RFI) attack, exploiting a vulnerability to execute malicious scripts from a remote server.

Our records indicate the IP spread multiple executable infector spyware causing system malfunction.

Unknown source code changes in our system were linked back to this offensive IP address.

The IP was involved in a FTP Anonymity attack, exploiting anonymous FTP access to upload or download files without detection.

The IP attempted to brute force the password to gain mail account access.