It was making constant NDR (Non-Deliverable Receipt) or backscatter attacks by generating large amount of invalid email addresses.

This IP belongs to American Express.

This IP belongs to Sprint.

This IP belongs to PythonAnywhere.

This IP belongs to Dell Technologies.

The IP tried to carry out illegal 'HTTP Request Smuggling' to fool the Apache server.

It attempted to use the FTP server to distribute virus creation tools.

Attempted to conduct numerous data harvesting strategies to gather sensitive user data.

This IP belongs to Tyson Foods.

The malicious IP was reported for engaging in port scanning, probing the server for open ports to discover potential vulnerabilities for exploitation.

GET /manager/html: Signals an attempt to access the Tomcat Application Manager.

This IP is linked to the distribution of commercial keyloggers designed to capture users' keystrokes.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

The IP attempted to launch Ciphertext attacks, trying to decrypt SSH-encrypted communication.

There were several attempts from this IP to manipulate our server DNS records.

This IP belongs to Oracle Cloud Infrastructure.

It attempted to use the FTP server to distribute network scanning tools.

The IP initiated a 'Deauth' attack, knocking legitimate users off the Apache service.

It was found that the IP has been exploiting zero-day vulnerabilities in our system.

Participated in a botnet attack to overwhelm our server’s resources.

The IP attempted to use the Mail server to relay malware-infected attachments to other servers.

Attempts to access sensitive areas of the server, such as the admin page or user account information.

The IP made multiple requests with identical Accept-Encoding headers.

It attempted to use the VOIP server to perform a reflection DDoS attack.

GET //web-console/Invoker: Might be an attempt to access JBoss server's web console for exploitation.