The IP attempted to perform XML Injection attacks on the Apache server.

GET /etc/passwd: An attempt to retrieve Linux server user account details.

The IP attempted to perform XML Injection attacks on the Apache server.

This specific IP was marked for unauthorized browser changes implying browser hijackers.

The IP made multiple requests with the same X-UIDH header.

This IP addressed employed a method of brute force attack attempting to compromise our systems.

The IP was involved in a Caller ID Spoofing attack, falsifying the caller ID to deceive the receiver or hide the caller's identity.

The IP attempted to perform a distributed denial of service attack on the SSH server.

This particular IP tried to perform an unauthorized system configuration change.

This IP belongs to Microsoft.

It pushed humongous quantities of spam emails through our server, aiming to congest our email services.

System logs trace back the distribution of trojans that could allow for remote access to this suspicious IP.

This IP belongs to MTS (Mobile TeleSystems).

The IP tried to execute Malware/Ransomware attacks via mail attachments.

The IP actively participated in snowshoe spamming, spreading its spam output across many IPs and domains to avoid detection.

It attempted to use the FTP server to distribute zombie network tools.

Repeated attempts to access the server using insecure or deprecated methods.

Multiple requests with the same X-Forwarded-For header.

This IP belongs to Procter & Gamble.

Damaging activities showing connections to rootkit attacks were associated with this IP.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

The IP has been implicated in multiple cases of URL manipulation attempts.

The IP made repeated attempts to authenticate with the VOIP server using different usernames.

It attempted to perform a phishing attack using the IMAP server.

Multiple requests using HTTP methods that are not typically used (e.g., TRACE).