It attempted to perform HTTP Response Splitting attacks on the Apache server.

HTTP Fingerprinting: Sequential requests that aim to identify server software types and version numbers.

The IP performed Covert Timing Channel attacks, gathering information about encrypted SSH traffic by analyzing packet timing.

It sent VOIP requests to non-existent extensions.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

The IP attempted to use the FTP server to distribute zero-day exploit tools.

It attempted to perform a password spraying attack on the POP3 server.

This IP belongs to World Fuel Services.

GET //web-console/Invoker: Might be an attempt to access JBoss server's web console for exploitation.

The malicious IP was reported for trying to perform a VoIP Phreaking attack, exploiting weaknesses in VoIP systems to make free calls or disrupt services.

The IP attempted to execute unauthorized commands on the SSH server.

This IP belongs to Citigroup.

The IP conducted exhaustive dictionary attacks, trying to guess password and username combinations.

Tried to perform a man-in-the-middle attack to intercept and alter communication between the server and clients.

This malicious IP was reported for attempting a Session Hijacking attack, exploiting a valid computer session to gain unauthorized access to information or services.

GET /manager/html: Signals an attempt to access the Tomcat Application Manager.

The suspicious IP indulged in Mitnick attacks, manipulating user trust to gain confidential info.

This IP belongs to Alibaba Cloud Services.

This IP belongs to British Telecommunications.

POST /xmlrpc.php: Could indicate an attempt at exploiting the WordPress xmlrpc.php file, often used for brute forcing.

The IP was involved in a war dialing attack, dialing a large number of phone numbers to find modems, fax machines, and unsecured VoIP devices.

It attempted to perform IP Spoofing attacks on the Apache server.

The IP address has been involved in distributing adware to our server systems.

The suspicious IP indulged in Mitnick attacks, manipulating user trust to gain confidential info.

It executed directory traversal attempts to access unauthorized directories / folders in our server.