A string of malicious e-commerce apps installations were linked to this IP.

The IP launched exploitation attacks based on the infamous 'Heartbleed' OpenSSL cryptographic vulnerabilities.

The malicious IP was reported for trying to perform a VoIP Phreaking attack, exploiting weaknesses in VoIP systems to make free calls or disrupt services.

Multiple requests with the same If-Range header.

The IP made multiple unsuccessful login attempts to the SASL server in a short period of time.

It partook in location spoofing, making it appear from different locations.

Multiple requests to the password reset page.

This IP belongs to AT&T.

The identified IP address was involved in planting backdoor programs that give excessive control over infected systems.

Repeated requests for the same file or page, indicating an attempt to crack a password or exploit a vulnerability.

The IP attempted to use the POP3 server to distribute malware.

The IP attempted to use the FTP server to distribute DDoS attack tools.

This IP belongs to McKesson.

Repeated attempts to use the same password across multiple accounts.

This malicious IP was reported for attempting a FTP Spoof attack, falsifying its IP address to bypass IP-based access controls on the FTP server.

The IP launched HTTP tunnel attacks, attempting to wrap other protocols in HTTP to bypass network filters.

Conducted various IP scans, seeking loopholes in our network's security.

It attempted to use the FTP server to distribute traffic monitoring tools.

This IP belongs to Anthem.

This IP belongs to Morgan Stanley.

The IP address was flagged for employing a packet sniffer on our network.

This IP belongs to Airtel.

POST /xmlrpc.php: Could indicate an attempt at exploiting the WordPress xmlrpc.php file, often used for brute forcing.

The IP actively participated in snowshoe spamming, spreading its spam output across many IPs and domains to avoid detection.

It attempted zero-day attacks, exploiting unknown vulnerabilities in pop3.