This IP has been flagged for attempting to escalate privileges in our network.

Unusual patterns of behavior, such as login attempts at regular intervals or sequential patterns in the attempted passwords.

This IP belongs to Deutsche Telecom.

The IP was seen trying to perform a PASV FTP Bounce attack, misusing the passive mode to scan other hosts and ports.

It attempted to perform a Teardrop attack on the SSH server.

The malicious IP was found to be running an Internet Relay Chat (IRC) bot, potentially spreading malware or launching Distributed Denial-of-Service (DDoS) attacks.

Repeated attempts to access the server using old or outdated software versions, which might have known vulnerabilities.

Usage of Obscure HTTP Verbs: Seeing non-standard HTTP methods like DEBUG, PUT, or CONNECT could imply a web-based attack.

Repeated attempts to upload or execute files, which can indicate an attempt to install malicious software.

Rudimentary attempts were made by this IP to execute Man-in-the-Browser attacks.

It attempted to perform a Teardrop attack on the SSH server.

It was flagged initiating reflective (DRDoS) attacks, intending to exhaust our server resources.

This IP belongs to Sysco.

It attempted to send emails with malicious links from the Postfix server.

This malicious IP was reported for attempting a FTP Bounce attack, exploiting the FTP protocol's proxy command to scan ports and networks.

The IP attempted to perform DNS Spoofing attacks on the Apache server.

The IP attempted to use the FTP server to distribute forensics tools.

WAF Bypassing Attempts: Requests with suspicious payloads designed to bypass Web Application Firewalls.

It attempted to use the FTP server to distribute zombie network tools.

POST /user/password?name[0,%20bypass]=dav&name[0]=loup&pass-reset-token-1=D&form_id=user_pass: Drupalgeddon2 exploit which allows remote code execution.

It attempted to use the FTP server to distribute network scanning tools.

The IP attempted to perform Session Fixation attacks on the Apache server.

The IP attempted a pass-the-hash attack, trying to authenticate without knowing the plaintext password.

Unusual patterns in session IDs.

It engaged in mail bombing, flooding the server with large amounts of insignificant mails.