The malicious IP initiated numerous HTTP flood attacks, designed to overwhelm the Apache server with requests.

This IP belongs to McKesson.

It attempted to perform Session Sidejacking attacks on the Apache server.

The IP partook in Drive-by attacks, embedding malicious scripts on benign websites.

Multiple requests with the same Proxy-Authorization header.

It was observed attempting to conduct a replay attack, resending captured SSH packets in hopes of session hijacking.

Login Attempts with Automated User-Agents: Logs reflect requests to login page with 'bot' or 'spider' in user-agent strings.

This IP was caught distributing malicious APK files.

It utilized a Directory Harvest Attack, attempting to find valid e-mail addresses through guesswork.

It attempted to delete emails from the POP3 server without authorization.

The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

Command Injection in Requests: Logs indicate HTTP requests with Unix or Windows command-line instructions.

The IP was seen launching a DDoS attack on the Asterisk server, overwhelming it with traffic to disrupt its normal functioning.

The IP attempted to send emails from the Mail server pretending to be from a different sender.

It made numerous requests to the same endpoint in a short time.

The malicious IP attempted to exploit server misconfigurations to gain higher-level access.

It attempted to execute unauthorized commands on the Apache server.

The IP attempted to perform a man-in-the-middle (MitM) attack to intercept SSH communication.

This malicious IP was reported for attempting to perform a FTP Format String attack, exploiting format string vulnerabilities to crash the FTP server or execute arbitrary code.

It tried to use the email server for bounce spam, of sending out spam to third parties with forged return paths.

It appears this IP was linked to a number of drive-by-download attacks, silently downloading spyware.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

Last night, we received an alert regarding this IP attempting to upload keyloggers to our network.

This malicious IP was reported for trying to intercept VoIP calls, a type of eavesdropping attack aimed at capturing sensitive information.

This IP belongs to Microsoft.