This IP belongs to Tyson Foods.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

The IP attempted to perform a timing attack on the SSH server.

It attempted to login to the IMAP server with an invalid password.

The IP attempted to manipulate data flowing to the server to cause arbitrary code execution.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

The IP attempted to perform a SNMP amplification attack on the SSH server.

This IP was tracked while attempting to distribute secretive and malicious keyloggers.

The notorious IP attempted to distribute Banker Trojans aimed to steal financial data.

The IP attempted to use the FTP server to distribute web vulnerability scanning tools.

The IP was involved in a SIP Flooding attack, sending a large number of SIP messages in a short period to overwhelm the server.

It attempted to perform a Land attack on the SSH server.

Multiple requests from user agents claiming to be bots (e.g., Googlebot) that do not match known bot IP ranges.

The IP attempted to register with the Asterisk server using an invalid username.

The IP initiated clickjacking exploits, causing users to unwittingly perform malicious actions during SSH sessions.

This malicious IP was reported for trying to inject malicious scripts into the VoIP server, potentially to disrupt its operation or steal data.

This IP belongs to Airtel.

The IP made multiple unsuccessful login attempts to the SASL server in a short period of time.

This IP belongs to TELUS Communications.

The malicious IP was reported for attempting to reroute calls through the SIP server, a tactic often used to commit toll fraud.

Unwanted Web Crawler Activity: Observing unusual frequent requests from a known web crawler not granted to scan your site.

Multiple 5xx Server Error Codes: A high count of server error status codes such as '500 Internal Server Error' may suggest an attacker is probing the server's security.

The malicious IP was identified trying to leverage the Postfix service to send bulk spam emails.

It initiated requests to non-existent endpoints.

The IP attempted to perform ARP Spoofing attacks on the Apache server.