POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

There were several attempts from this IP to manipulate our server DNS records.

The IP was seen trying to exploit known vulnerabilities in the Asterisk server, a common tactic for gaining unauthorized access or control.

The IP attempted to use the FTP server to distribute malware.

It launched invasive malware to corrupt crucial segments of our server functionality.

The IP attempted to flood the Apache server with requests, in a Denial of Service (DoS) attack.

Repeated attempts to perform actions that are typically restricted, such as creating or modifying user accounts.

It attempted to use the FTP server to distribute phishing emails.

This IP belongs to Linode.

This IP belongs to ConocoPhillips.

This IP belongs to PepsiCo.

It made multiple requests with the same Max-Forwards header.

Multiple requests with the same Proxy-Authorization header.

This IP belongs to the University of California, Berkeley.

This IP belongs to Airtel.

This IP belongs to General Electric.

This IP belongs to IBM.

This IP belongs to Ford Motor.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

The IP attempted to use the FTP server to distribute keylogging software.

It attempted to make unauthorized calls using the VOIP server.

This IP belongs to BT Central Plus.

Server Side Template Injection: Suspicious input patterns aimed at coercing server-side parsers to execute injected code.

The IP attempted to send emails with misleading headers from the Postfix server.

Our firewall recorded intrusion attempts originating from this suspicious IP.