The malicious IP was seen trying to perform a Replay attack, capturing SIP authentication data and resending it to gain unauthorized access.

The IP tried to crack S/MIME encryption for accessing secured email contents.

POST /user/register: An attempt to register a new user or brute force the user registration form.

GET /errors.log: Shows an actor trying to access server error logs.

Multiple login attempts using different usernames, suggesting an attacker is trying to guess the correct username/password combination.

This malicious IP attempted a brute force attack, trying to crack login credentials to gain unauthorized access to a system or account.

Multiple requests using HTTP methods that are not typically used (e.g., TRACE).

It initiated SSL-Stripping attacks, aiming to downgrade secure HTTPS connections to less-secure HTTP.

Numerous incidents of botnet infestations were traced back to this offensive IP address.

It launched a privilege escalation attack aiming to gain unauthorized access with higher-level permissions.

It carried out key logging attempts, hoping to record keyboard inputs during SSH sessions.

This IP belongs to World Fuel Services.

This IP belongs to KT Corporation.

The IP attempted to use the POP3 server to relay spam.

The IP attempted to perform Session Replay attacks on the Apache server.

The IP attempted Forceful Browsing, trying to discover hidden directories or files which could contain SSH access data.

The IP attempted to use the FTP server to distribute malware.

This IP injected exploit kit into our system, taking advantage of software vulnerabilities.

The IP attempted to delete files from the FTP server.

The IP attempted to use the FTP server to distribute hacking tutorials.

The IP attempted to perform a downgrade attack on the SSH server.

Probing for Hidden Files: HTTP requests for files that should not be publicly accessible could suggest an attacker probing for unsecured content.

The IP was noted for executing SYN flood attacks, purposefully creating half-open connections to deplete server resources.

The IP initiated clickjacking exploits, causing users to unwittingly perform malicious actions during SSH sessions.

This IP belongs to Exelon.