This IP belongs to Sysco.

The IP attempted to send emails from the Mail server to blacklisted email addresses.

The IP attempted to send emails from the Postfix server that violate the server's email sending limits.

It attempted to use the SASL server to relay spam.

It was observed attempting to exploit known vulnerabilities in the IMAP protocol.

The IP made numerous attempts at SMTP Relay abuse by trying to send emails not meant for or from local users.

The IP attempted to perform a dictionary attack on the POP3 server.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

The IP attempted to perform HTTP Request Smuggling attacks on the Apache server.

The malicious IP initiated numerous HTTP flood attacks, designed to overwhelm the Apache server with requests.

It participated in Unvalidated Redirects and Forwards attacks, leading users to malicious websites via altered SSH links.

It attempted to send emails from the POP3 server without authorization.

Actively performed packet spoofing, obscuring the origin point of its own malicious packets.

This IP belongs to Johnson & Johnson.

It initiated requests to non-existent endpoints.

This IP belongs to Oracle.

It attempted to make unauthorized calls using the SIP server.

This IP belongs to PLDT.

This IP belongs to PLDT.

It attempted to use the FTP server to distribute password recovery tools.

Multiple login attempts with slight variations in the password, suggesting a dictionary attack, a type of brute force attack.

SQL Injection in HTTP Requests: Logs record HTTP requests that contain SQL statements. Possible strings could include 'SELECT *' or 'DROP TABLE', indicative of a SQL injection attack.

It tried to create buffer overflows by sending large amounts of data at once to overwhelm server resources.

This IP belongs to Citigroup.

It sent SIP INVITE requests to non-existent extensions.