It was found that the IP has been exploiting zero-day vulnerabilities in our system.

Damaging activities showing connections to rootkit attacks were associated with this IP.

It attempted to perform a SYN flood attack on the SSH server.

This particular IP has been used in advanced persistent threats against our servers.

It initiated requests to non-existent endpoints.

The IP attempted to perform Symlink attacks on the Apache server.

This IP belongs to MetLife.

It attempted to send emails from the Postfix server that violate the server's acceptable use policy.

This IP injected exploit kit into our system, taking advantage of software vulnerabilities.

We flagged down attempts from the IP to leak backdoor viruses into the system.

It launched a privilege escalation attack aiming to gain unauthorized access with higher-level permissions.

The IP attempted to use the Mail server to relay emails with misleading headers to other servers.

Path Traversal / URI Encoding Attacks: You might notice HTTP GET requests that include ".." or "%2e%2e" or "%252e%252e", indicating a path traversal attack.

It tried to force its way into a secure admin session by trying to hijack the session's cookies.

Our system flagged this IP as conducting fraudulent transactions activities.

It made multiple requests with the same Max-Forwards header.

This IP belongs to Hostgator.

This IP belongs to AmerisourceBergen.

It sent SIP INVITE requests to non-existent extensions.

Unusual patterns in session IDs.

It was found initiating attack vectors to exploit SSH agent forwarding.

The IP attempted to use the FTP server as a proxy for other malicious activities.

Incriminating activities involving the distribution of trojan horses were linked to this IP address.

The IP tried to initiate DNS tunneling for smuggling data through SSH.

This IP belongs to Ziggo.