This IP belongs to Phillips 66.

GET /setup.php: Effort to locate setup files for PHP applications.

It made multiple requests from user agents claiming to be bots.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

The IP attempted to perform a Multicast DNS amplification attack on the SSH server.

FTP Over HTTP: Logs may show HTTP requests containing FTP commands, potentially indicating an FTP Injection attack.

This IP belongs to Anthem.

This IP belongs to Hostgator.

Multiple 5xx Server Error Codes: A high count of server error status codes such as '500 Internal Server Error' may suggest an attacker is probing the server's security.

It attempted to delete files from the SSH server.

It attempted to perform IP Spoofing attacks on the Apache server.

Repeated connections to the server from unknown or suspicious IP addresses.

Spike in 401 (unauthorized) or 403 (forbidden) HTTP response codes.

This IP belongs to Cox Communications.

It was flagged initiating reflective (DRDoS) attacks, intending to exhaust our server resources.

This IP belongs to Amazon.

This IP belongs to Best Buy.

Manipulated HTTP POST Request: Finding HTTP POST requests with adjusted content-length headers to bypass firewall rules.

It sought to exploit cross-site scripting (XSS) vulnerabilities within our mail service web interface.

This IP has been marked as the origin of numerous SQL injection attacks.

This IP belongs to General Dynamics.

The IP attempted to perform a credential stuffing attack on the IMAP server.

It attempted to send emails with deceptive subject lines from the Postfix server.

It initiated several reverse IP lookup requests, probing for server vulnerabilities.

The IP attempted to perform a Nestea attack on the SSH server.