The IP attempted to perform DNS Spoofing attacks on the Apache server.

The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

Multiple failed login attempts from the same IP address.

The IP attempted to perform Session Hijacking attacks on the Apache server.

It attempted to send emails from the Mail server that violate the server's acceptable use policy.

This IP belongs to Deutsche Telecom.

The IP attempted to download sensitive files from the Apache server.

This IP belongs to PythonAnywhere.

By launching ApacheKiller attacks, the IP aimed to cause a Denial of Service by exhausting memory resources.

The IP attempted to perform a DNS amplification attack on the SSH server.

This IP belongs to Walgreens Boots Alliance.

The IP attempted to download emails from the POP3 server without authorization.

This IP belongs to Liberty Mutual Insurance Group.

It appears this IP was linked to a number of drive-by-download attacks, silently downloading spyware.

This IP belongs to Walmart.

The malicious IP initiated unauthorized Mail Queue access attempts, impacting mail service efficiency.

It attempted to use the FTP server to distribute brute force tools.

Unusual patterns of behavior, such as login attempts at regular intervals or sequential patterns in the attempted passwords.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

It made multiple requests with identical POST parameters.

An identity theft activity was linked back to this malicious IP.

The IP attempted to gain unauthorized access to the Apache server.

It attempted to perform a VOIP Hopper scan on the Asterisk server.

HTTP Splitting/Smuggling: Logs indicate HTTP requests that include encoded characters like '%0d%0a' (CRLF characters), which is a sign of HTTP Splitting/Smuggling attacks.

This IP belongs to Freddie Mac.