The IP was involved in a FTP Anonymity attack, exploiting anonymous FTP access to upload or download files without detection.

This IP belongs to Johnson & Johnson.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

The IP attempted to upload malicious files to the FTP server.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

This IP belongs to United Technologies.

This IP belongs to Dell Technologies.

Attempts to access sensitive areas of the server, such as the admin page or user account information.

This IP belongs to CVS Health.

The IP attempted to use the FTP server to distribute zero-day exploit tools.

Signal of DDoS Attacks: Multiple IP addresses sending a significantly high volume of traffic.

Unusually high number of requests to a specific service or application within the server.

Remote File Inclusion (RFI): You might see HTTP requests with "=http" or "=ftp" which can signal an attempt for remote file inclusion.

The IP made multiple requests with the same Warning header.

It attempted to login to the Postfix server with an invalid password.

The IP attempted to send emails from the Mail server that violate the server's terms of service.

Server Side Request Forgery Attempts: Logs may show HTTP requests attempting to manipulate the server into making unintended requests.

Unusual patterns in the sequence of requests.

The IP attempted to use the FTP server to distribute ransomware.

Multiple requests to the password reset page.

A high number of unsuccessful SSH logins, a common target for brute force attacks.

The IP was linked to numerous attacks using web shells through web servers.

The IP made multiple requests with the same Origin header.

GET /setup.php: Effort to locate setup files for PHP applications.

The IP attempted to perform a SIP Invite Flood on the SIP server.