This malicious IP was reported for attempting a FTP Bounce attack, exploiting the FTP protocol's proxy command to scan ports and networks.

It was making constant NDR (Non-Deliverable Receipt) or backscatter attacks by generating large amount of invalid email addresses.

This IP had been flagged for attempting to manipulate server behaviour by injecting shellcodes.

The IP attempted to manipulate data flowing to the server to cause arbitrary code execution.

The IP was involved in distributing malware, infecting systems or networks to steal data, cause damage, or gain unauthorized access.

The IP attempted to send emails from the Mail server pretending to be from a different sender.

Unauthorized Access Attempts to Admin Directories: Repeated HTTP requests to known admin directories.

The malicious IP was involved in a vishing attack, using the VoIP server to deceive users into revealing sensitive information.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

This IP belongs to Sony Network Communications.

The IP tried to perform a cross-site request forgery attack on the IMAP service.

This malicious IP was involved in a Clickjacking attack, tricking users into clicking on something different from what the user perceives, potentially leading to confidential information disclosure or takeover of their computer.

Suspicious user account behavior, such as accounts being used at odd hours or performing unusual tasks.

This IP belongs to The Walt Disney Company.

The IP address attempted to login to the IMAP server with an invalid username.

Actively performed packet spoofing, obscuring the origin point of its own malicious packets.

The IP attempted to perform a Fraggle attack on the SSH server.

The IP attempted to use the POP3 server to relay spam.

Various incidents of unwanted installation of malicious gaming apps were traced back to this IP.

This IP belongs to McKesson.

GET /db/finance.dump: An attempt to access a database dump file.

This IP belongs to AmerisourceBergen.

Multiple Sequential Page Requests: Quick, sequential requests to all pages of a site could be someone scanning for vulnerabilities.

The IP attempted to download emails from the IMAP server without authorization.

Repeated requests for the same file or page, indicating an attempt to crack a password or exploit a vulnerability.