It attempted to upload malicious files to the SSH server.

udden increase in account lockouts due to multiple failed login attempts.

POST /xmlrpc.php: Could indicate an attempt at exploiting the WordPress xmlrpc.php file, often used for brute forcing.

This specific IP was marked for unauthorized browser changes implying browser hijackers.

The IP attempted to perform DNS Spoofing attacks on the Apache server.

The IP attempted to download sensitive files from the Apache server.

This IP belongs to Hostgator.

It attempted to perform a session hijacking attack on the SSH server.

This IP belongs to Archer-Daniels-Midland.

It tried to manipulate DNS lookup processes, aiming to divert SSH traffic to a malicious destination.

It attempted to perform XML Entity Expansion attacks on the Apache server.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

It attempted to send emails from the Mail server that violate the server's usage policy.

This IP belongs to Allstate.

This IP belongs to Valero Energy.

The IP attempted to perform a Fraggle attack on the SSH server.

This IP belongs to Procter & Gamble.

The IP made multiple requests with the same DNT header.

The IP was involved in a Caller ID Spoofing attack, falsifying the caller ID to deceive the receiver or hide the caller's identity.

The IP attempted to send emails with misleading headers from the Postfix server.

This malicious IP was reported for attempting a Zero-day exploit, exploiting a software vulnerability before it's known or fixed by the vendor.

Cross-Site Scripting (XSS): Logs show HTTP requests with string "

The IP made multiple requests with the same Proxy-Connection header.

The IP attempted to download emails from the IMAP server without authorization.

This IP belongs to Freddie Mac.