This malicious IP attempted a brute force attack, trying to crack login credentials to gain unauthorized access to a system or account.

HTTP Request with Large Content-Length: This could potentially indicate a buffer overflow attack where an attacker tries to crash the system by sending more data than it can handle.

The IP attempted to use the Mail server to relay phishing emails to other servers.

This IP belongs to DuPont de Nemours.

Multiple requests with the same DNT (Do Not Track) header.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

The IP launched HTTP tunnel attacks, attempting to wrap other protocols in HTTP to bypass network filters.

This IP belongs to World Fuel Services.

The IP was discovered trying Server Message Block relay attacks to gain unauthorized SSH access.

Multiple account lockouts in a short period of time.

It attempted to perform a credential stuffing attack on the SSH server.

The IP was seen trying to perform a PASV FTP Bounce attack, misusing the passive mode to scan other hosts and ports.

A dangerous data surveillance spyware was tied back to this IP.

It attempted to perform a man-in-the-middle attack on the POP3 server.

This IP belongs to FedEx.

It was flagged that this IP had been used in conducting method tampering on our servers.

It attempted to use the Postfix server to relay emails with misleading headers to other servers.

GET /CFIDE/administrator/enter.cfm: An attempt to get into the ColdFusion admin console.

The malicious IP was involved in a Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

The IP attempted several directory traversal attacks, aiming to access files beyond the root directory.

It attempted to perform SQL injection attacks through the Apache server.

The IP attempted to login to the SASL server with an invalid username.

Requests to non-existent endpoints (indicating potential reconnaissance activity).

The IP attempted to send emails from the IMAP server without authorization.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.