GET /db/finance.dump: An attempt to access a database dump file.

It appeared to be taking part in SSL Stripping attacks, downgrading secure HTTPS connections to facilitate eavesdropping.

This IP belongs to Charter Communications.

The IP was actively engaged in spear-phishing attacks, aimed at high-ranking officials within our network.

The IP attempted to perform Symlink attacks on the Apache server.

Malicious Script Execution: Execution attempts of suspicious scripts or encoded payloads often seen in URI parameters or request bodies.

GET /wp-json/wp/v2/users: Trying to extract a list of WordPress users via the REST API.

This IP belongs to Valero Energy.

The IP attempted to launch Ciphertext attacks, trying to decrypt SSH-encrypted communication.

Multiple requests to the same endpoint in a short period of time.

This IP belongs to Vkontakte.

It showed unusual patterns in the sequence of requests.

This IP belongs to Walmart.

This IP belongs to New York Life Insurance.

The IP was identified as operating a Registration Bot (REG-Bot), automating the creation of multiple fake accounts on various platforms.

This IP was distributing rogue security software, misleading users to think their systems are infected.

The IP attempted to use the FTP server to distribute secure deletion tools.

Multiple requests with the same X-Forwarded-For header.

The IP attempted to exploit known vulnerabilities in the Asterisk protocol.

The IP made multiple requests with the same If-Match header.

This IP belongs to Phillips 66.

An identity theft activity was linked back to this malicious IP.

This IP belongs to Alphabet.

Unusual increase in server CPU usage.

It attempted to use the FTP server to distribute encryption tools.