This IP belongs to Airtel.

POST /xmlrpc.php: Could indicate an attempt at exploiting the WordPress xmlrpc.php file, often used for brute forcing.

The IP engaged in a mail relay attack, using our server to send spam.

POST /upload.php: An attempt to upload a possibly malicious file.

This IP made wrongful manipulations indicating the operation of malicious downgrader.

The IP attempted to perform a replay attack on the POP3 server.

Multiple requests with the same DNT (Do Not Track) header.

The IP attempted to perform Stack Overflow attacks on the Apache server.

It attempted to perform a credential stuffing attack on the SASL server.

The said IP was the source of several rootkit deployment attempts.

It was found actively trying to exploit HTTP Response Splitting vulnerabilities to perform further attacks.

This IP belongs to Boeing.

Excessive Form Submission Attempts: Numerous form submission attempts within a short time, signifying brute-force or captcha bypass attempts.

This IP belongs to T-Mobile.

Unexpected changes in the server configuration or installed software.

The IP attempted to perform a Ping of Death attack on the SSH server.

It attempted to perform a password spraying attack on the IMAP server.

The IP attempted to perform a replay attack on the IMAP server.

It utilized a Directory Harvest Attack, attempting to find valid e-mail addresses through guesswork.

A large number of requests from a single user agent, suggesting an automated process.

The IP initiated a 'Deauth' attack, knocking legitimate users off the Apache service.

This IP belongs to Linode.

The IP attempted to download sensitive files from the Apache server.

The IP was marked attempting to use infamous 'Ramnit' malware to steal sensitive Apache server data.

This IP is linked to the distribution of commercial keyloggers designed to capture users' keystrokes.