This IP belongs to General Electric.

The handler of this IP has been exploiting scumware to disrupt our users' browsing experience.

The IP attempted to perform a DNS amplification attack on the SSH server.

It attempted multiple LDAP injection attacks to gain unauthorized access.

The malicious IP was reported for attempting to manipulate file permissions on the FTP server, potentially to gain unauthorized access or expose sensitive data.

The malicious IP was involved in a Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.

High Frequency POST Requests: Numerous or unusual POST requests in a short time span could indicate a dictionary or brute force attack on a login page.

Multiple requests with identical Accept-Charset headers.

The IP address has been involved in distributing adware to our server systems.

Inclusion of Binary Data in HTTP Request: If binary data is included in the HTTP request, this could suggest an attacker is attempting a binary exploit.

This IP belongs to Cardinal Health.

This IP belongs to Mondelez International.

The malicious IP was reported for attempting to manipulate file permissions on the FTP server, potentially to gain unauthorized access or expose sensitive data.

Shell Injection: Logs show requests containing command line shell syntax, suggesting shell command injection.

The IP attempted the notorious Shellshock vulnerability, which could pose a severe threat to our server's resources.

The IP attempted to use the POP3 server to distribute malware.

Login attempts using old or outdated protocols.

The IP attempted to use the FTP server to distribute zero-day exploit tools.

The IP attempted to perform a key exchange attack on the SSH server.

It attempted to send emails from the Mail server that violate the server's acceptable use policy.

The IP attempted to send emails with misleading headers from the Mail server.

It made multiple attempts to initiate malicious File Transfer Protocol (FTP) sessions with the Postfix service.

Our system blocked an attempted Code Injection attack from this IP.

The IP attempted to use the FTP server to distribute web vulnerability scanning tools.

It attempted to use the FTP server to distribute identity theft tools.