This IP belongs to Walmart.

It attempted to delete emails from the IMAP server without authorization.

Multiple Requests from Different IPs with Same User-Agent: This could be a signal of a coordinated attack originating from compromised machines.

The IP made repeated attempts to authenticate with the Asterisk server using different usernames.

The IP was observed participating in Social Engineering attacks to manipulate individuals into revealing SSH login details.

It attempted to send emails from the Mail server to email addresses that have previously marked emails from the server as spam.

This IP belongs to America Movil.

The IP attempted to send emails with misleading headers from the Mail server.

The IP has been traced back to system monitors, aiming to watch and record user activity.

This IP belongs to ConocoPhillips.

The IP exhibited unusual patterns in the Accept-Language header.

GET /wp-config.php~: Requesting the backup files which may expose sensitive information.

This IP belongs to Cardinal Health.

It attempted to send phishing emails from the Mail server.

It was caught injecting malicious code into the SSH session attempting to compromise server integrity.

It attempted to perform Heap Overflow attacks on the Apache server.

It attempted to perform Race Condition attacks on the Apache server.

It attempted to perform Local File Inclusion (LFI) attacks on the Apache server.

It was observed attempting to exploit known vulnerabilities in the IMAP protocol.

It attempted to perform Server Side Request Forgery (SSRF) attacks on the Apache server.

Multiple requests with the same Warning header.

This malicious IP attempted a brute force attack, trying to crack login credentials to gain unauthorized access to a system or account.

Attempts to use automated scripts or tools for password cracking.

The IP attempted to change file permissions on the SSH server.

This malicious IP was reported for trying to perform a FTP Buffer Overflow attack, sending more data to a buffer than it can handle, causing it to overflow and allowing the attacker to execute arbitrary code.