The IP has been traced back to system monitors, aiming to watch and record user activity.

It attempted to perform a password spraying attack on the POP3 server.

This IP belongs to State Farm Insurance.

HTTP Request with Odd Timing: Very precisely timed HTTP requests could imply an automated tool or bot.

This IP belongs to Deere.

The IP was involved in a SIPVicious attack, a specific type of VoIP attack that scans for open SIP servers and then attempts to crack their passwords.

Multiple requests using HTTP methods that are not typically used (e.g., TRACE).

This IP belongs to TIAA.

This IP belongs to American Express.

Multiple requests with the same X-Att-Deviceid header.

It initiated a Phishing attack, making fake requests to the server pretending to be a legit user.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

This IP belongs to Ford Motor.

This IP belongs to Sony Network Communications.

The IP was seen trying to exploit known vulnerabilities in the Asterisk server, a common tactic for gaining unauthorized access or control.

The IP was seen trying to perform a FTP Reflection attack, using the FTP server to amplify its DDoS attack traffic.

Excessive Subdomain Requests: A large number of requests for non-existing subdomains could suggest a subdomain takeover attempt.

The IP address has been involved in distributing adware to our server systems.

The IP attempted to send emails from the Postfix server to blacklisted email addresses.

This IP belongs to Reliance Jio.

It attempted to make unauthorized calls using the Asterisk server.

It made various efforts to insert spyware to monitor SSH communications covertly.

It was identified as a BadBot, a type of bot that performs malicious activities.

This IP belongs to Microsoft.

The IP had a series of targeted attacks distributing SpyAgents with spying functionalities.