This IP belongs to State Farm Insurance.

The said IP was the source of several rootkit deployment attempts.

The IP made multiple requests with the same Via header.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.

The IP attempted to perform HTTP Verb Tampering attacks on the Apache server.

The IP attempted to perform a QOTD amplification attack on the SSH server.

GET /ELMAH.axd: Attempting to exploit ELMAH (Error Logging Modules and Handlers) misconfiguration in ASP.NET sites.

This IP belongs to Oracle.

The IP was involved in a rapid sequence of login attempts.

It attempted to perform a session hijacking attack on the SSH server.

The IP attempted to list the contents of directories that it should not have access to.

Evidence of Fast-flux DNS: Rapidly changing DNS responses signifying the presence of a botnet.

GET /db/finance.dump: An attempt to access a database dump file.

This IP belongs to JPMorgan Chase.

Unknown source code changes in our system were linked back to this offensive IP address.

Multiple requests with the same X-Forwarded-For header.

This IP belongs to Citigroup.

The delivery of spyware, aimed at gathering sensitive information, was originated from this IP.

It attempted to delete emails from the IMAP server without authorization.

It tried to create buffer overflows by sending large amounts of data at once to overwhelm server resources.

Repeated attempts to access the server using insecure or deprecated methods.

It attempted to send emails from the Mail server to a large number of recipients.

This IP belongs to TJX.

The IP attempted to upload malicious files to the FTP server.

Requests to non-existent endpoints (indicating potential reconnaissance activity).