The IP was seen trying to perform a PASV FTP Bounce attack, misusing the passive mode to scan other hosts and ports.

This IP belongs to IBM.

It attempted to send emails from the Mail server that violate the server's email content policy.

A high number of unsuccessful SSH logins, a common target for brute force attacks.

The IP address was found roaming through the network, scanning for weak spots.

The IP had been flagged for initiating SYN flood attacks on our servers.

The IP attempted to use the FTP server as a proxy for other malicious activities.

This IP belongs to McKesson.

The IP attempted to perform a BitTorrent amplification attack on the SSH server.

Several instances of password stealers were traced back to this notorious IP.

The IP attempted to register as a SIP user with no password.

This IP belongs to Travelers Cos.

The IP was seen trying to perform a call transfer to an external number, a potential sign of toll fraud.

It initiated requests to non-existent endpoints.

It made various efforts to insert spyware to monitor SSH communications covertly.

GET /internal/: Browsing an internal directory.

It was discovered illicitly scanning the server for potential vulnerabilities.

The IP was involved in a Directory Traversal attack on the FTP server, attempting to access restricted directories and files.

This IP belongs to Wells Fargo.

It attempted mail bombing, trying to overwhelm our mail server with high volumes of email.

This IP belongs to McKesson.

This IP belongs to Cardinal Health.

It initiated SSL-Stripping attacks, aiming to downgrade secure HTTPS connections to less-secure HTTP.

The IP attempted to register with the VOIP server using an invalid username.

The IP attempted to use the FTP server as a proxy for other malicious activities.