This IP belongs to Cox Communications.

It attempted to perform a man-in-the-middle attack on the POP3 server.

It attempted to use the FTP server to distribute intrusion detection system (IDS) evasion tools.

The IP partook in Drive-by attacks, embedding malicious scripts on benign websites.

The IP tried creating false server responses hoping to disrupt the SASL service.

The IP made multiple requests using uncommon HTTP methods.

This IP belongs to Bank of America.

Repeated attempts to alter or delete log files to cover tracks.

GET /xampp/phpmyadmin/: A threat actor trying to access unprotected phpMySQL instances tied to XAMPP installations.

This IP belongs to Nintendo.

This IP belongs to Berkshire Hathaway.

This IP belongs to Verizon Communications.

The IP was seen performing a CSRF (Cross-site request forgery) attack to manipulate user actions.

It attempted to send emails from the Mail server to email addresses that have previously marked emails from the server as spam.

This IP belongs to Publix Super Markets.

This IP belongs to Allstate.

The IP attempted to perform Integer Overflow attacks on the Apache server.

It made multiple requests with the same Range header.

The IP was seen trying to change the configuration settings of the Asterisk server, potentially to disable security features.

This IP belongs to DuPont de Nemours.

System logs trace back the distribution of trojans that could allow for remote access to this suspicious IP.

GET /muieblackcat: This is often a precursor for additional scanning and likely attacks.

The IP attempted to bypass IP blacklisting by rapidly changing its IP address.

The IP was involved in a war dialing attack, dialing a large number of phone numbers to find modems, fax machines, and unsecured VoIP devices.

The IP attempted to perform a Nestea attack on the SSH server.