The IP made multiple requests with the same Origin header.

The IP attempted to delete files from the FTP server.

GET /phpMyAdmin: This could be a threat actor looking for an unsecured phpMyAdmin page.

This IP belongs to Microsoft Azure.

This IP belongs to Intel.

The IP was involved in a toll fraud attack, making long-distance calls without authorization, leading to high charges.

The IP attempted to perform a Kad network amplification attack on the SSH server.

The IP attempted to upload malicious files to the FTP server.

Incidents of privacy-invasive software floating in our network were linked to this IP.

the IP made attempts at wiretapping the network to monitor SSH traffic patterns and gather useful information.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

It attempted to use the VOIP server to perform a reflection DDoS attack.

The IP attempted to perform a replay attack on the POP3 server.

It attempted to perform Local File Inclusion (LFI) attacks on the Apache server.

The IP was seen trying to perform a PASV FTP Bounce attack, misusing the passive mode to scan other hosts and ports.

A high number of unsuccessful SSH logins, a common target for brute force attacks.

The IP attempted to perform Security Misconfiguration attacks on the Apache server.

The IP attempted to register as a VOIP user with no password.

Login attempts using old or outdated protocols.

The IP performed regular system foot printing to gain intel on weak points in our server.

This IP exhibited malicious sophistication by employing multi-vector attacks.

The IP was involved in distributing malware, infecting systems or networks to steal data, cause damage, or gain unauthorized access.

This IP belongs to State Farm Insurance.

GET /muieblackcat: This is often a precursor for additional scanning and likely attacks.

This IP belongs to Goldman Sachs Group.