This specific IP was marked for unauthorized browser changes implying browser hijackers.

Cross-Site Scripting (XSS): Logs show HTTP requests with string "

This IP belongs to Dreamhost.

This IP belongs to Tumblr.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

POST /xmlrpc.php: Could indicate an attempt at exploiting the WordPress xmlrpc.php file, often used for brute forcing.

The IP made multiple requests to the server's robots.txt file.

GET /errors.log: Shows an actor trying to access server error logs.

Incidents of privacy-invasive software floating in our network were linked to this IP.

The IP attempted to perform Directory Traversal attacks on the Apache server.

Suspicious URL Encoding: Seeing HTTP requests with a lot of %, suggesting URL encoding to evade detection.

Web-based Command Injection: Logs indicating command injection attempts via web-based forms or query parameters.

This IP belongs to IBM.

The IP was seen attempting a FTP Smurf attack, flooding the FTP server with echo request packets to cause a denial of service.

The IP attempted to send emails from the Mail server that violate the server's email sending limits.

This IP belongs to Alphabet.

This IP belongs to KDDI.

The malicious IP was reported for engaging in port scanning, probing the server for open ports to discover potential vulnerabilities for exploitation.

Multiple attempts to access the server using encrypted tunnels or proxies.

This IP belongs to Cardinal Health.

The IP sent malformed SIP requests, potentially indicating an attempt to crash the server.

It attempted to use the Asterisk server to perform a reflection DDoS attack.

The IP attempted to perform XML Injection attacks on the Apache server.

https://mellrakforum.hu/forums/users/melbetpakistanorg/

Unusual User-Agent: Logs show requests with abnormal, uncommon or non-standard User-Agent strings.