This IP belongs to McKesson.

Signs of Credential Stuffing: A high number of failed logins could indicate credential stuffing attacks.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

It attempted to use the FTP server to distribute password recovery tools.

The IP tried creating false server responses hoping to disrupt the SASL service.

It attempted to perform a Sentinels amplification attack on the SSH server.

Rapid sequence of login attempts.

Open ip

Open ip

The IP used a 'Poodle' attack in attempts to downgrade the server's SSL to a more vulnerable state.

It attempted to send phishing emails from the Postfix server.

The malicious IP engaged in distributed denial of service (DDoS) attacks, exhausting server resources and disrupting SSH services.

The malicious IP was reported for attempting a RTP Replay attack, capturing RTP packets and resending them to disrupt communication.

GET /administrator.php: Attempting to access an admin interface.

Attempted to conduct numerous data harvesting strategies to gather sensitive user data.

This IP belongs to Linode.

The IP attempted to manipulate trusted authorities by conducting SSL strip attacks.

The IP attempted to perform Missing Function Level Access Control attacks on the Apache server.

Multiple Requests from Different IPs with Same User-Agent: This could be a signal of a coordinated attack originating from compromised machines.

Multiple requests with the same X-Wap-Profile header.

Damaging activities showing connections to rootkit attacks were associated with this IP.

This IP belongs to Virgin Media.

It attempted to perform a SIPVicious scan on the Asterisk server.

It attempted to use the SIP server to perform a reflection DDoS attack.

Repeated pings or probe requests to the server, indicating a potential reconnaissance effort before the attack.