The IP address attempted to login to the Mail server with an invalid username.

The IP was reported for attempting a Cross-Site Scripting attack, injecting malicious scripts into websites to steal data or disrupt functionality.

The IP made multiple requests with the same X-UIDH header.

GET //web-console/Invoker: Might be an attempt to access JBoss server's web console for exploitation.

This IP belongs to The Walt Disney Company.

It attempted to send emails from the POP3 server without authorization.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

The IP attempted to execute unauthorized commands on the SSH server.

GET /administrator.php: Attempting to access an admin interface.

It performed botnet operations, controlling a group of “zombie” computers to amplify its DDoS attacks.

It made multiple requests with the same Range header.

The IP attempted to create new directories on the FTP server.

The IP attempted to use the FTP server to distribute credit card fraud tools.

The IP was seen attempting a FTP Command Injection attack, inserting malicious commands into legitimate FTP requests.

Fileless malware dissemination has been observed from this IP address.

Multiple requests with identical POST parameters.

The IP address attempted to login to the Mail server with an invalid username.

The IP attempted to mark emails as read on the POP3 server without authorization.

This IP belongs to Berkshire Hathaway.

Repeated attempts to access directories or files that do not exist or are typically not accessed.

The IP attempted to perform a distributed denial of service attack on the SSH server.

The IP performed forceful browsing, to access and exploit unprotected files and directories.

The IP attempted to perform a dictionary attack on the POP3 server.

This IP was reported for attempting to use the SIP server to mask its true location and identity, a common tactic in VoIP phishing attacks.

The IP tried to initiate DNS tunneling for smuggling data through SSH.