GET /vuln.html: Looking for any page vulnerabilities.

The IP was seen trying to exploit known vulnerabilities in server software, a common tactic for gaining unauthorized access or control.

Suspicious URL Encoding: Seeing HTTP requests with a lot of %, suggesting URL encoding to evade detection.

This IP belongs to Telkom SA.

This IP belongs to McKesson.

The IP attempted to use the FTP server to distribute spam.

This IP belongs to the United States Department of Defense.

GET /server-status: Often an attempt to check Apache server status.

Repeated attempts to access the server using insecure or deprecated methods.

The IP attempted to perform a BitTorrent amplification attack on the SSH server.

This malicious IP was reported for attempting to perform a FTP Port Stealing attack, hijacking the data connection of an existing FTP session.

This IP belongs to Google Cloud Services.

This IP belongs to UnitedHealth Group.

It appears that this IP was initiating DNSChanger malware attacks on our network.

This IP was accused of multiple unauthorized removal of security certificates.

The IP made multiple requests using uncommon HTTP methods.

This IP belongs to Target.

It attempted to perform XPath Injection attacks on the Apache server.

This IP belongs to Wells Fargo.

It attempted to perform a SIPVicious scan on the SIP server.

The malicious IP was suspected of cryptojacking, illicitly using others' computing resources to mine cryptocurrencies.

The IP sent malformed SIP requests, potentially indicating an attempt to crash the server.

This IP gave off a red flag for hosting a hidden command and control server for malicious bots.

It initiated SSL-Stripping attacks, aiming to downgrade secure HTTPS connections to less-secure HTTP.

This IP executed mass-probing of various ports to seek vulnerabilities.