This IP belongs to Cigna.

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

Repeated Broken Authentication: Tons of successful authentication requests with unassociated actions could depict broken authentication mechanism.

Unusual patterns in the sequence of requests.

Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.

This IP belongs to Phillips 66.

Server Side Request Forgery Attempts: Logs may show HTTP requests attempting to manipulate the server into making unintended requests.

It attempted to perform XPath Injection attacks on the Apache server.

The IP attempted to send emails from the Postfix server pretending to be from a different sender.

FTP Over HTTP: Logs may show HTTP requests containing FTP commands, potentially indicating an FTP Injection attack.

Distributed session hijackers from the IP were designed to capture and exploit web browser sessions.

This malicious IP was reported for attempting a Smurf attack, flooding a target system via spoofed broadcast ping messages.

The IP under scrutiny has been associated with multiple modem hijackers.

HTTP Request with Large Content-Length: This could potentially indicate a buffer overflow attack where an attacker tries to crash the system by sending more data than it can handle.

It initiated SSL-Stripping attacks, aiming to downgrade secure HTTPS connections to less-secure HTTP.

Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.

The IP attempted to use the FTP server to distribute data recovery tools.

This IP belongs to MetLife.

This IP belongs to Cigna.

The IP address has been marked as the source of RAM scrapers aiming to steal sensitive data.

The IP also engaged in website cloning, creating mirror websites to trick users into sharing sensitive data.

GET /administrator.php: Attempting to access an admin interface.

The IP attempted 'DLL Injection' to alter the server's behavior in a malicious manner.

The IP attempted to perform XML Attribute Blowup attacks on the Apache server.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.