GET /vuln.html: Looking for any page vulnerabilities.

GET /cgi-bin/test.cgi: Could indicate the threat actor is trying to exploit older, less secure scripting interfaces.

The IP attempted several directory traversal attacks, aiming to access files beyond the root directory.

It attempted to use the SIP server as a relay for calls to premium-rate numbers.

It was flagged initiating reflective (DRDoS) attacks, intending to exhaust our server resources.

This IP belongs to Allstate.

The IP attempted to perform XML Injection attacks on the Apache server.

The IP attempted fileless malware attacks, directly injecting malicious script into server memory.

This IP belongs to Boeing.

This IP belongs to Alibaba Cloud Services.

This IP belongs to JPMorgan Chase.

The IP attempted to send malware-infected attachments from the Postfix server.

This IP belongs to TJX.

Our data indicates this IP has performed data breaches by launching phishing attacks.

This IP belongs to Abbott Laboratories.

This IP belongs to Ford Motor.

Our team traced back the IP responsible for multiple mobile device tracking software distributions.

The malicious IP attempted ARP spoofing to fool the server into sending information to the wrong destination.

The IP was involved in a SIP brute force attack, attempting to guess SIP authentication credentials to gain unauthorized access.

The IP attempted to use the POP3 server to relay spam.

This IP belongs to Vkontakte.

The IP performed regular system foot printing to gain intel on weak points in our server.

It attempted to perform IP Spoofing attacks on the Apache server.

HTTP Request with Odd Timing: Very precisely timed HTTP requests could imply an automated tool or bot.

Multiple login attempts from different geographical locations in a short period of time.