The IP has been implicated in multiple cases of URL manipulation attempts.

The IP attempted logins at unusual times.

It attempted to perform a Newtear attack on the SSH server.

The IP attempted to download sensitive files from the SSH server.

This IP was involved in a Remote File Inclusion (RFI) attack, exploiting a vulnerability to execute malicious scripts from a remote server.

It attempted to perform a side channel attack on the SSH server.

The IP attempted session sidejacking, seeking to take over SSH sessions post-authentication.

This IP belongs to Exxon Mobil.

The IP attempted to use the Mail server to relay spam to other servers.

It attempted to perform a SIPVicious scan on the Asterisk server.

It attempted to perform a credential stuffing attack on the SASL server.

The IP initiated IP spoofing, fooling our systems to trust its malicious communication.

This IP belongs to Gilead Sciences.

The IP was seen traffic sniffing, trying to spy on and analyse network packets for potential server vulnerabilities.

The IP sent malicious links via IM softwares, aiming to spread instant messaging worms.

The IP attempted to perform a NetBIOS amplification attack on the SSH server.

This IP belongs to Allstate.

This IP belongs to General Motors.

It attempted to perform Session Prediction attacks on the Apache server.

The IP attempted to send malware-infected attachments from the Mail server.

Multiple login attempts using different usernames, suggesting an attacker is trying to guess the correct username/password combination.

The IP initiated a 'Deauth' attack, knocking legitimate users off the Apache service.

Uncommon Referer Header: HTTP logs record requests from an uncommon or suspicious 'Referer' header.

Too Many HTTP 404 Errors: A high number of 404 Page Not Found errors may indicate an attacker trying to find valid directories or pages.

The malicious IP was reported for sending a high volume of SIP INVITE requests, a potential sign of a call flooding attack.