An identity theft activity was linked back to this malicious IP.

The IP was involved in a Ping of Death attack, sending packets larger than the maximum allowed size, causing the system to freeze or crash.

The IP attempted to use the Mail server to relay malware-infected attachments to other servers.

Participated in the notorious Water Torture attack to overload our DNS servers.

The IP was involved in a Caller ID Spoofing attack, falsifying the caller ID to deceive the receiver or hide the caller's identity.

The IP attempted to use the FTP server to distribute credit card fraud tools.

This IP belongs to Amazon.

The delivery of spyware, aimed at gathering sensitive information, was originated from this IP.

It attempted to upload malicious files to the SSH server.

This IP belongs to General Electric.

Various incidents of unwanted installation of malicious gaming apps were traced back to this IP.

The malicious IP was involved in Smurf attacks, amplifying its denial-of-service attack using internet host IP network links.

The IP maliciously used packet sniffers in attempts to decode SSH traffic.

GET /server-status: Often an attempt to check Apache server status.

The IP tried to crack S/MIME encryption for accessing secured email contents.

The IP attempted a Rootkit installation to gain root access and control server activity.

It made multiple requests with identical POST parameters.

Multiple requests from user agents claiming to be bots (e.g., Googlebot) that do not match known bot IP ranges.

The IP was involved in a RTP Mix attack, injecting RTP packets into an ongoing VoIP call to disrupt communication.

It attempted to perform Uncontrolled Format String attacks on the Apache server.

This IP belongs to Honeywell International.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

It attempted to use the SIP server to perform a reflection DDoS attack.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.