The IP was seen trying to perform a Fraggle attack, a type of DDoS attack where the attacker sends a large amount of UDP traffic to a router's broadcast network.

It attempted to use the Postfix server to relay emails with misleading headers to other servers.

This IP belongs to Verizon Communications.

Multiple account lockouts in a short period of time.

It attempted to perform Race Condition attacks on the Apache server.

This IP belongs to British Telecommunications.

The IP attempted several directory traversal attacks, aiming to access files beyond the root directory.

Multiple requests with the same Referer header.

This IP belongs to Steam.

Remote File Inclusion (RFI): You might see HTTP requests with "=http" or "=ftp" which can signal an attempt for remote file inclusion.

This IP belongs to Citigroup.

This IP belongs to DuPont de Nemours.

The IP attempted to change file permissions on the SSH server.

The IP attempted to register as a SIP user with no password.

This IP belongs to Softbank.

The malicious IP was involved in a vishing attack, using the VoIP server to deceive users into revealing sensitive information.

This malicious IP attempted a brute force attack, trying to crack login credentials to gain unauthorized access to a system or account.

Rapid sequence of login attempts.

GET /administrator.php: Attempting to access an admin interface.

Attempts to login using a sequential list of passwords, indicating a possible brute force attack.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.

Probing for Hidden Files: HTTP requests for files that should not be publicly accessible could suggest an attacker probing for unsecured content.

It attempted zero-day attacks, exploiting unknown vulnerabilities in pop3.

It attempted to perform Race Condition attacks on the Apache server.

Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.