POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

It launched header-based exploits, attempting to manipulate HTTP headers to cause inappropriate server responses.

This IP belongs to GitHub.

It attempted to send emails with deceptive subject lines from the Mail server.

The IP was seen attempting a FTP Command Injection attack, inserting malicious commands into legitimate FTP requests.

Server Misconfiguration Exploitation: Logs illustrating attempts at exploiting known server misconfigurations.

The IP made multiple unsuccessful login attempts to the SASL server in a short period of time.

GET /jmx-console/: An attempt to access the JMX console on a JBoss server.

Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.

This malicious IP was reported for attempting to initiate a large number of simultaneous calls, a sign of a potential DDoS attack.

Multiple Sequential Page Requests: Quick, sequential requests to all pages of a site could be someone scanning for vulnerabilities.

This IP was reported for attempting a Teardrop attack, sending mangled IP fragments with overlapping and oversized payloads to crash the target network device.

The IP exhibited unusual patterns in the Accept-Language header.

The IP attempted to exploit known vulnerabilities in the Asterisk protocol.

The IP was involved in a Directory Traversal attack on the FTP server, attempting to access restricted directories and files.

This IP belongs to Walgreens Boots Alliance.

Multiple requests with identical Accept-Charset headers.

This IP belongs to Walmart.

The IP attempted to use the SASL server to relay phishing emails.

POST /user/register: An attempt to register a new user or brute force the user registration form.

Arbitrarily Long GET Requests: Very long GET requests may suggest an attacker is attempting a GET Flood DDoS attack.

Multiple requests with the same Max-Forwards header.

Multiple login attempts from different geographical locations in a short period of time.

The malicious IP was reported for attempting unauthorized logins to the SIP server, potentially to gain control over voice communication.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.