The IP made multiple unsuccessful login attempts to the IMAP server in a short period of time.

This IP belongs to World Fuel Services.

IP Spoofing: Logs showing HTTP requests with IP ranges that are typically reserved for private networks or an unusual X-Forwarded-For header.

This IP belongs to The Walt Disney Company.

Our firewall recorded intrusion attempts originating from this suspicious IP.

It was found actively trying to exploit HTTP Response Splitting vulnerabilities to perform further attacks.

The IP has initiated several exploits, specifically for software vulnerabilities.

The IP made multiple unsuccessful login attempts to the IMAP server in a short period of time.

It attempted to perform a brute force attack on the POP3 server.

Code Injection: Usage of standard codes (like Base64) to obscure attack payloads or commands.

This IP belongs to Phillips 66.

This IP belongs to Cisco Systems.

The malicious IP was reported for attempting to reroute calls through the SIP server, a tactic often used to commit toll fraud.

This malicious IP was reported for attempting to perform a FTP Port Stealing attack, hijacking the data connection of an existing FTP session.

The IP was flagged for performing XML External Entity attacks, exploiting improperly processed XML inputs.

The IP attempted to perform a replay attack on the IMAP server.

The IP mounted HTTP Parameter Pollution attacks, disrupting server processes by injecting adulterated parameters.

The IP mounted HTTP Parameter Pollution attacks, disrupting server processes by injecting adulterated parameters.

The IP was seen trying to perform a PASV FTP Bounce attack, misusing the passive mode to scan other hosts and ports.

The IP initiated a 'Deauth' attack, knocking legitimate users off the Apache service.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

The IP initiated clickjacking exploits, causing users to unwittingly perform malicious actions during SSH sessions.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

Multiple requests with the same TE (Transfer Encoding) header.

Multiple requests with the same X-UIDH header.