This IP belongs to Johnson & Johnson.

Actively performed packet spoofing, obscuring the origin point of its own malicious packets.

This IP belongs to Boeing.

This IP had been flagged for attempting to manipulate server behaviour by injecting shellcodes.

Attempts to access the server using stolen or leaked credentials.

The IP attempted to send emails with misleading headers from the Postfix server.

Server Scanning for Software Version: Influx of HTTP requests attempting to detect software version running on the server.

implemented multiple decryption attacks to gain unauthorized access to encrypted email data.

Executed email spoofing attempts pretending to be a trusted party.

It initiated a Phishing attack, making fake requests to the server pretending to be a legit user.

Damaging activities showing connections to rootkit attacks were associated with this IP.

Bursts of login attempts followed by periods of inactivity, suggesting an attacker is trying to avoid detection.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

This IP belongs to Chevron.

This IP has been linked to numerous occurrences of spyware distribution within our networks.

This IP belongs to Tech Data.

It made multiple requests with the same X-Att-Deviceid header.

A majority of our user base received phishing emails originated from this particular IP address.

It attempted to exploit known vulnerabilities in the IMAP protocol.

This IP belongs to Humana.

It actively attempted to employ session-splicing techniques, interacting with multiple SSH sessions simultaneously to smudge its attack trace.

This IP belongs to OVH.

It attempted to login to the FTP server with an invalid password.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

It attempted to perform a SIPVicious scan on the Asterisk server.