This IP belongs to 3M.

POST /xmlrpc.php: Could indicate an attempt at exploiting the WordPress xmlrpc.php file, often used for brute forcing.

It attempted to perform XML Entity Expansion attacks on the Apache server.

The IP maliciously used packet sniffers in attempts to decode SSH traffic.

Attempts to access the server using credentials that have been involved in previous security incidents.

Malicious Script Execution: Execution attempts of suspicious scripts or encoded payloads often seen in URI parameters or request bodies.

continue reading this https://onlinecrashgame.space/en/lucky-jet/

Unusually high CPU usage, which can indicate a brute force attack is in progress.

This IP was implicated in attempts to inject ransomware into our systems.

System logs have traced multiple cases of our servers being bombed with trojans to this IP.

Repeated attempts to access the server using old or outdated software versions, which might have known vulnerabilities.

The IP was involved in a DDoS attack, sending massive amounts of traffic to overwhelm a server and disrupt its normal functioning.

This malicious IP was reported for trying to perform a FTP Zombie Scan, using the FTP server to mask its true location and identity.

GET /modules/productpageadverts/uploadimage.php: This is related to a known vulnerability in the Prestashop module productpageadverts.

It attempted to use the SASL server to distribute malware.

This IP belongs to McKesson.

This IP belongs to Kroger.

The IP performed Covert Timing Channel attacks, gathering information about encrypted SSH traffic by analyzing packet timing.

Multiple requests with the same X-UIDH header.

The IP attempted various header manipulation attacks, aiming to bypass spam filters.

This IP belongs to Wells Fargo.

It attempted to send emails from the Mail server to a large number of recipients.

GET /login.action: Trying to find a Struts2 application to exploit.

It appeared to be taking part in SSL Stripping attacks, downgrading secure HTTPS connections to facilitate eavesdropping.

The IP was involved in an Email Spoofing attack, sending emails with a forged sender address, often used in phishing and spam campaigns.