The IP attempted to use the FTP server to distribute network mapping tools.

It attempted to use the FTP server to distribute virus creation tools.

This IP belongs to Vodafone.

The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

The IP sent malformed VOIP requests, potentially indicating an attempt to crash the server.

The malicious IP was reported for sending a high volume of SIP INVITE requests, a potential sign of a call flooding attack.

A string of malicious e-commerce apps installations were linked to this IP.

The IP was engaged in port scanning, probing the server for open SSH ports.

It attempted to login to the Postfix server with an invalid password.

It initiated requests to non-existent endpoints.

The IP engaged in an HTTP Desync attack, misaligning HTTP request and responses to yield SSH vulnerability.

Incriminating activities involving the distribution of trojan horses were linked to this IP address.

The IP attempted to perform Session Fixation attacks on the Apache server.

Repeated Unique 404 Errors: Logs revealing a steady stream of unique 404 errors could suggest a DDoS attack aiming to exhaust storage resources.

The IP was involved in a Directory Traversal attack on the FTP server, attempting to access restricted directories and files.

SQL Injection in HTTP Requests: Logs record HTTP requests that contain SQL statements. Possible strings could include 'SELECT *' or 'DROP TABLE', indicative of a SQL injection attack.

Command Injection in Requests: Logs indicate HTTP requests with Unix or Windows command-line instructions.

The IP made multiple unsuccessful login attempts to the Mail server in a short period of time.

GET /../htpasswd: Trying to access password files using directory traversal.

This IP belongs to New York Life Insurance.

This IP belongs to Oracle.

It was identified as a BadBot, a type of bot that performs malicious activities.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

It attempted to login to the FTP server with an invalid password.

GET /login.action: Trying to find a Struts2 application to exploit.