This IP belongs to McKesson.

It initiated a Phishing attack, making fake requests to the server pretending to be a legit user.

The IP tried to initiate DNS tunneling for smuggling data through SSH.

The IP attempted to upload malicious files to the FTP server.

FTP Over HTTP: Logs may show HTTP requests containing FTP commands, potentially indicating an FTP Injection attack.

The IP was discovered trying Server Message Block relay attacks to gain unauthorized SSH access.

This IP belongs to Morgan Stanley.

The IP made multiple unsuccessful login attempts to the Postfix server in a short period of time.

It launched Smurf Attacks, trying to overload our mail server by utilizing internet host IP network links.

It attempted to perform Man in the Middle (MitM) attacks on the Apache server.

This IP belongs to United Technologies.

The IP attempted to execute unauthorized commands on the SSH server.

The malicious IP was reported for attempting unauthorized logins to the SIP server, potentially to gain control over voice communication.

It attempted to perform XML Entity Expansion attacks on the Apache server.

This IP belongs to Lowe's.

The IP tried to exploit buffer overflow vulnerabilities to run unauthorized code.

The IP attempted to perform DNS Spoofing attacks on the Apache server.

Multiple requests with identical request parameters.

It made multiple attempts to initiate malicious File Transfer Protocol (FTP) sessions with the Postfix service.

It tried to use the email server for bounce spam, of sending out spam to third parties with forged return paths.

Multiple requests with the same X-Requested-With header.

This IP belongs to Exxon Mobil.

Ping of Death: Logs showing oversized ICMP requests could suggest Ping of Death attacks.

It attempted to perform a password spraying attack on the POP3 server.

This IP belongs to WordPress.com.