The IP attempted to perform a SIPVicious scan on the VOIP server.

This IP belongs to Pinterest.

The IP attempted to perform Format String attacks on the Apache server.

The IP attempted to perform a downgrade attack on the SSH server.

It attempted to use the FTP server to distribute encryption tools.

It attempted to use the IMAP server to relay spam.

This IP belongs to United Continental Holdings.

It attempted to perform Session Sidejacking attacks on the Apache server.

GET /errors.log: Shows an actor trying to access server error logs.

The IP was seen traffic sniffing, trying to spy on and analyse network packets for potential server vulnerabilities.

The IP attempted to perform a phishing attack using the SASL server.

This malicious IP was reported for attempting a man-in-the-middle attack on the VoIP server, intercepting and potentially altering communication.

This malicious IP was reported for trying to perform a FTP Zombie Scan, using the FTP server to mask its true location and identity.

It attempted to use the FTP server to distribute terrorist propaganda.

This IP belongs to Walgreens Boots Alliance.

It started header injection or email injection attempts, by adding extra data into the headers and confusing the server processes.

The IP attempted to use the Mail server to relay emails with misleading headers to other servers.

It attempted to perform a SIP Register Flood on the SIP server.

The IP attempted to perform a VOIP Hopper scan on the SIP server.

This IP belongs to BT Central Plus.

This IP belongs to Telstra.

This IP belongs to Liberty Mutual Insurance Group.

This IP belongs to Citigroup.

The malicious IP was involved in a credential stuffing attack, using stolen username-password combinations to gain unauthorized access.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.