It attempted to carry out a 'Ping of Death' operation, hoping to crash the server.

The IP set off alarms for an attempted man-in-the-middle attack on our servers.

We linked several cryptojacking attempts, aimed at harnessing our system resources, to this IP.

POST /j_security_check: May indicate an attempt to bypass Java server page (JSP) login mechanisms.

This IP was associated with targeted spear phishing attempts against our senior staff.

The IP was caught attempting to exploit known vulnerabilities within Postfix to gain unauthorized access.

The IP conducted exhaustive dictionary attacks, trying to guess password and username combinations.

Multiple requests to the server's robots.txt file.

System logs have traced multiple cases of our servers being bombed with trojans to this IP.

The IP sent malicious links via IM softwares, aiming to spread instant messaging worms.

This IP belongs to Deutsche Telecom.

This IP belongs to United Continental Holdings.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

It made multiple requests with the same Max-Forwards header.

Multiple requests from different IP addresses in a short span of time, suggesting a distributed brute force attack.

Attempted to conduct numerous data harvesting strategies to gather sensitive user data.

This IP belongs to Orange France Telecom.

The IP tried to execute Malware/Ransomware attacks via mail attachments.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

This IP belongs to Comcast.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

This IP belongs to World Fuel Services.

A series of active scareware campaigns was traced back to this IP address.

This IP belongs to Walmart.

It made multiple requests with identical cookies.