POST /modules/raptor_file_manager/upload.php: Attempt to use a known flaw in the Raptor file manager for arbitrary file upload.

It partook in location spoofing, making it appear from different locations.

The IP showed unusual patterns in referrer URLs.

Multiple account lockouts in a short period of time.

This IP belongs to General Electric.

The IP address attempted to login to the SSH server with an invalid username.

Malformed HTTP Version: Observation of logs where HTTP/1.1 or HTTP/2.0 replaced with an unusual alternative to bypass security tools.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

Unusual TCP/IP Headers: Logs reflect HTTP requests with unusual or altered TCP/IP headers, an attempt to confuse or slip through security measures.

It attempted to perform Man in the Middle (MitM) attacks on the Apache server.

Shell Injection: Logs show requests containing command line shell syntax, suggesting shell command injection.

Repeated requests for the same file or page, indicating an attempt to crack a password or exploit a vulnerability.

This IP has been observed spreading mobile malware, targeting our company application users.

The IP address was flagged for employing a packet sniffer on our network.

It engaged in a click fraud operation using our server’s communication channels.

This malicious IP was reported for attempting a FTP Spoof attack, falsifying its IP address to bypass IP-based access controls on the FTP server.

Unusual system or application errors related to authentication or access controls.

The IP launched timing attacks, trying to understand our server timings for potential future exploits.

The IP attempted to perform XML Injection attacks on the Apache server.

This IP belongs to Valero Energy.

Spear Phishing Attempts: Rare but possible to find indicators of spear-phishing campaigns targeting your employees or users.

The IP attempted to send malware-infected attachments from the Mail server.

The IP initiated clickjacking exploits, causing users to unwittingly perform malicious actions during SSH sessions.

This IP blocked legitimate users by performing IP hijacking.

The IP attempted to use the FTP server to distribute malware.