GET /server-status: Often an attempt to check Apache server status.

The IP attempted to launch Ciphertext attacks, trying to decrypt SSH-encrypted communication.

This malicious IP was reported for attempting a Session Hijacking attack, exploiting a valid computer session to gain unauthorized access to information or services.

The IP attempted to use the FTP server to distribute data recovery tools.

The IP was involved in a FTP Anonymity attack, exploiting anonymous FTP access to upload or download files without detection.

It attempted to perform a Quake Network Protocol amplification attack on the SSH server.

It showed unusual activity in the server's error logs.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

It attempted logins using outdated protocols.

The IP tried to perform a cross-site request forgery attack on the IMAP service.

It was detected trying to perform cross-site scripting to bypass the same origin policy on Apache.

The IP attempted to perform a replay attack on the POP3 server.

The malicious IP was involved in a Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

This IP belongs to Prudential Financial.

The IP attempted to send emails from the IMAP server without authorization.

GET /axis2/axis2-admin/login: Attempt at finding Axis2 web service exploitable applications.

It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

This IP belongs to Pinterest.

The IP has been implicated in multiple cases of URL manipulation attempts.

It attempted to perform a brute force attack on the POP3 server.

This IP was reported for attempting a Dictionary attack on the VoIP server, systematically entering every word in a dictionary as a password to find the correct one.

It tried to use Cross-site scripting (XSS) attacks to inject malicious scripts into webpages viewed by users.

The IP launched HTTP tunnel attacks, attempting to wrap other protocols in HTTP to bypass network filters.

It carried out IP spoofing to mimic a trusted IP with the intent of gaining unauthorized SSH access.

The IP was seen trying to upload files to the FTP server, possibly with the intent of distributing malware.