The IP has been implicated in multiple cases of URL manipulation attempts.

The IP partook in Drive-by attacks, embedding malicious scripts on benign websites.

Unauthorized HTTP Method Usage: Logs showing unauthorized methods being attempted on the server, like TRACE or PATCH.

Attempts to login using a sequential list of passwords, indicating a possible brute force attack.

It attempted to send emails from the Mail server to email addresses that have previously marked emails from the server as spam.

It attempted to perform a man-in-the-middle attack on the POP3 server.

This IP belongs to United Continental Holdings.

The said IP was the source of several rootkit deployment attempts.

The IP attempted to send malware-infected attachments from the Mail server.

This IP belongs to Philip Morris International.

The IP made repeated attempts to authenticate with the VOIP server using different usernames.

POST /wp-admin/admin-ajax.php: The Actor may be trying to exploit some vulnerable WordPress theme or plugin.

It sent unusually large SIP packets, potentially indicating a buffer overflow attempt.

An identity theft activity was linked back to this malicious IP.

This malicious IP was reported for attempting a Session Hijacking attack, exploiting a valid computer session to gain unauthorized access to information or services.

GET /index.php?param=: Attempting a cross-site scripting (XSS) attack.

It attempted to perform Server Side Request Forgery (SSRF) attacks on the Apache server.

The IP attempted to perform Missing Function Level Access Control attacks on the Apache server.

Multiple attempts to access the server using anonymous or generic user accounts.

The IP was involved in a FTP Injection attack, exploiting vulnerabilities in the FTP server to execute unauthorized commands.

Unusually high number of requests to a specific service or application within the server.

It tried to exploit Apache Struts vulnerabilities to compromise our web applications.

It attempted to send phishing emails from the Postfix server.

A sudden spike in bandwidth usage, which can indicate a brute force attack.

The IP was involved in a RTP Bleeding attack, exploiting vulnerabilities in the VoIP server to listen to ongoing calls.