GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

The IP was identified as operating a Registration Bot (REG-Bot), automating the creation of multiple fake accounts on various platforms.

The IP made multiple unsuccessful login attempts to the SASL server in a short period of time.

This IP belongs to Valero Energy.

It attempted to use the Postfix server to relay emails with malicious links to other servers.

This IP belongs to Pfizer.

The IP attempted to use the FTP server to distribute VPN tools.

The IP attempted to gain unauthorized access to the Apache server.

This IP belongs to Bank of America.

The malicious IP initiated numerous HTTP flood attacks, designed to overwhelm the Apache server with requests.

This IP belongs to Bristol-Myers Squibb.

It initiated 'HOIC' (High Orbit Ion Cannon) to overload our Apache service with junk data.

This IP belongs to Sprint.

Made various attempts at a forged return-path attack, attempting to spoof their source email address.

It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

The IP exhibited unusual patterns in the Accept-Language header.

Distributed session hijackers from the IP were designed to capture and exploit web browser sessions.

Repeated attempts to access directories or files that do not exist or are typically not accessed.

This IP belongs to Ziggo.

The IP attempted to send spam emails from the Postfix server.

It attempted to perform a NTP amplification attack on the SSH server.

This IP belongs to Bristol-Myers Squibb.

The IP attempted to perform a dictionary attack on the POP3 server.

The IP made multiple requests using uncommon HTTP methods.

This IP was involved in a Remote File Inclusion (RFI) attack, exploiting a vulnerability to execute malicious scripts from a remote server.