This IP belongs to Deutsche Telekom AG.

This IP belongs to General Motors.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

The malicious IP attempted to exploit server misconfigurations to gain higher-level access.

This IP belongs to Proximus.

It attempted to use the FTP server to distribute zombie network tools.

It initiated Denial of Service (DoS) attacks with an aim to overwhelm and crash the SSH service.

The IP attempted to use the Mail server to relay emails with malicious links to other servers.

It attempted to perform Insecure Direct Object References attacks on the Apache server.

It initiated insecure direct object references (IDOR) attacks to bypass authorization and directly access SSH resources.

This IP belongs to Berkshire Hathaway.

A string of malicious e-commerce apps installations were linked to this IP.

This IP attempted to distribute malicious Javascript files.

We traced a significant increase in the distribution of malicious fake security software to the reported IP.

The IP was linked to numerous attacks using web shells through web servers.

It attempted to send emails from the Postfix server that violate the server's email content policy.

Multiple attempts to access the server using anonymous or generic user accounts.

The IP address was found roaming through the network, scanning for weak spots.

The IP sent numerous Asterisk OPTIONS requests in a short time.

Reverse Tabnabbing Attempts: Logs illustrating target="_blank" in URL, which is a sign of reverse tabnabbing attempt.

It attempted to perform a Sentinels amplification attack on the SSH server.

It repetitively attempted Port Scanning to identify open ports and related vulnerabilities.

The IP tried creating false server responses hoping to disrupt the SASL service.

The IP made multiple requests with the same If-Range header.

This IP belongs to TJX.