The IP was linked to numerous attacks using web shells through web servers.

the IP made attempts at wiretapping the network to monitor SSH traffic patterns and gather useful information.

This IP belongs to Jabil.

The IP attempted to perform a dictionary attack on the POP3 server.

This IP belongs to TIAA.

This IP belongs to Home Depot.

It attempted to perform a SIPVicious scan on the Asterisk server.

This IP belongs to Telstra.

This IP was caught circulating email worms, camouflaged as legitimate mails.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

The IP was involved in a Ping of Death attack, sending packets larger than the maximum allowed size, causing the system to freeze or crash.

POST /dav/addressbook?add.vcf: Trying to exploit CardDAV servers to store and spread malware.

It attempted to use the Postfix server to relay emails with malicious links to other servers.

The IP attempted to use the SASL server to relay phishing emails.

The IP attempted to download emails from the POP3 server without authorization.

The IP initiated fake traffic attacks to manipulate webpage rankings and conduct click fraud.

This IP was distributing rogue security software, misleading users to think their systems are infected.

The IP initiated a man-in-the-middle (MitM) attack, attempting to capture sensitive information during legitimate email exchange.

The IP address has been associated with unwanted browser toolbar installations.

It sent Asterisk requests to non-existent extensions.

It attempted to perform Uncontrolled Format String attacks on the Apache server.

It attempted to use the Postfix server to relay spam to other servers.

It attempted to delete files from the SSH server.

GET /admin: Looking for an unprotected admin page.

Attempts to use privileged service accounts outside of their normal usage patterns.