The IP was involved in distributing malware, infecting systems or networks to steal data, cause damage, or gain unauthorized access.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

The IP was involved in a war dialing attack, dialing a large number of phone numbers to find modems, fax machines, and unsecured VoIP devices.

It executed directory traversal attempts to access unauthorized directories / folders in our server.

It tried to use Cross-site scripting (XSS) attacks to inject malicious scripts into webpages viewed by users.

This IP belongs to Medium.

It tried to use the email server for bounce spam, of sending out spam to third parties with forged return paths.

This IP belongs to Archer-Daniels-Midland.

Because of numerous attacks using malicious mobile code, this IP has been blacklisted.

It attempted to perform a Newtear attack on the SSH server.

The IP launched exploitation attacks based on the infamous 'Heartbleed' OpenSSL cryptographic vulnerabilities.

Multiple failed login attempts using different usernames.

The IP was involved in a FTP Spam attack, using the FTP server to distribute unsolicited emails or messages.

The IP initiated dictionary attacks, hoping to guess the correct password combination.

The IP was seen trying to perform a call transfer to an external number, a potential sign of toll fraud.

Incidents of privacy-invasive software floating in our network were linked to this IP.

Multiple login attempts using different usernames, suggesting an attacker is trying to guess the correct username/password combination.

The IP was detected attempting to skirt our system's detection through spoofing.

The IP was involved in a war dialing attack, dialing a large number of phone numbers to find modems, fax machines, and unsecured VoIP devices.

The IP address attempted to login to the FTP server with an invalid username.

This malicious IP was reported for attempting a FTP Bounce attack, exploiting the FTP protocol's proxy command to scan ports and networks.

This IP belongs to Jabil.

This IP belongs to Comcast.

The delivery of spyware, aimed at gathering sensitive information, was originated from this IP.

The IP made multiple unsuccessful login attempts to the SASL server in a short period of time.