This IP belongs to IBM.

Unauthorized Access Attempts to Admin Directories: Repeated HTTP requests to known admin directories.

It attempted to execute unauthorized commands on the Apache server.

The IP attempted to use the FTP server to distribute web vulnerability scanning tools.

It was found that the IP had deployed rogue security software in our system.

FTP Over HTTP: Logs may show HTTP requests containing FTP commands, potentially indicating an FTP Injection attack.

Multiple attempts to access the server using anonymous or generic user accounts.

The IP attempted to perform a password spraying attack on the SSH server.

It attempted to send emails with malicious links from the Mail server.

The IP initiated a man-in-the-middle (MitM) attack, attempting to capture sensitive information during legitimate email exchange.

System logs have traced multiple cases of our servers being bombed with trojans to this IP.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

It attempted to perform Session Prediction attacks on the Apache server.

The IP attempted to perform Man in the Browser (MitB) attacks on the Apache server.

The IP was seen trying to perform a Fraggle attack, a type of DDoS attack where the attacker sends a large amount of UDP traffic to a router's broadcast network.

The IP attempted to perform a timing attack on the SSH server.

Multiple requests with the same TE (Transfer Encoding) header.

This IP belongs to Phillips 66.

Print Requests Repeatedly: Logs illustrate HTTP requests with "?print" parameter multiple times, indicating someone trying to expose sensitive information.

It showed unusual patterns in the sequence of requests.

Attempts to use automated scripts or tools for password cracking.

This IP belongs to Tech Data.

The IP was involved in a Directory Traversal attack, attempting to access restricted directories and files.

This IP had been flagged for attempting to manipulate server behaviour by injecting shellcodes.

This IP belongs to CHS.