This IP belongs to Honeywell International.

It engaged in mail bombing, flooding the server with large amounts of insignificant mails.

It made multiple requests with the same X-Att-Deviceid header.

The malicious IP was involved in a vishing attack, using the VoIP server to deceive users into revealing sensitive information.

It attempted to login to the Postfix server with an invalid password.

It attempted to perform a SIPVicious scan on the Asterisk server.

Headless Browser Activity: Logs may show HTTP requests with user-agent strings containing headless browser identifiers.

Repeated attempts to access rarely used or hidden services on the server.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

It attempted to login to the POP3 server with an invalid password.

This IP belongs to Amazon Web Services.

Multiple failed attempts to use the server’s API.

Unusual patterns in referrer URLs.

Multiple requests with the same TE (Transfer Encoding) header.

GET /configuration.php.old: Trying to locate backup configuration files.

The IP has been traced back to system monitors, aiming to watch and record user activity.

The IP was involved in a RTP Mix attack, injecting RTP packets into an ongoing VoIP call to disrupt communication.

This IP belongs to the United States Department of Defense.

This IP belongs to CenturyLink.

A sudden spike in bandwidth usage, which can indicate a brute force attack.

The IP tried to perform a cross-site request forgery attack on the IMAP service.

It attempted to perform a Chargen amplification attack on the SSH server.

It attempted to perform Buffer Overflow attacks on the Apache server.

The IP was involved in a Directory Traversal attack on the FTP server, attempting to access restricted directories and files.

POST /ckupload.php,: A threat actor attempting to exploit CKEditor’s file uploader.