The IP initiated fake traffic attacks to manipulate webpage rankings and conduct click fraud.

This IP belongs to Berkshire Hathaway.

This IP belongs to Target.

Friend

It attempted to list the contents of directories that it should not have access to.

This IP belongs to Phillips 66.

Multiple failed attempts to use the server’s API.

The IP was seen trying to perform a Spoofing attack, falsifying its IP address to deceive the FTP server.

This IP belongs to Phillips 66.

It attempted to upload malicious scripts to the Apache server.

Multiple requests with the same Referer header.

The IP was involved in a FTP Spam attack, using the FTP server to distribute unsolicited emails or messages.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

The IP made multiple requests with the same DNT header.

It attempted to send emails from the POP3 server without authorization.

The IP address was flagged for employing a packet sniffer on our network.

The IP attempted to perform XML External Entity (XXE) attacks on the Apache server.

This IP belongs to Goldman Sachs Group.

The IP attempted to perform a Kad network amplification attack on the SSH server.

This IP belongs to Alibaba Cloud Services.

This IP belongs to Facebook.

It attempted to change file permissions on the FTP server.

Multiple requests with the same X-Att-Deviceid header.

Bursts of login attempts followed by periods of inactivity, suggesting an attacker is trying to avoid detection.