This IP belongs to MetLife.

MITM Detection: Detection of duplicate TCP acknowledgements could suggest a Man-in-the-Middle (MITM) attack.

It attempted to exploit known vulnerabilities in the SSH protocol.

This IP belongs to Ziggo.

It repetitively attempted Port Scanning to identify open ports and related vulnerabilities.

Multiple failed login attempts using different usernames.

This IP belongs to United Technologies.

The malicious IP was reported for attempting unauthorized logins to the SIP server, potentially to gain control over voice communication.

The IP attempted to use the FTP server to distribute hacking tutorials.

This IP belongs to UnitedHealth Group.

The malicious IP was reported for sending malformed packets to the SIP server, potentially aiming to crash the system.

This IP belongs to Nike.

The IP attempted to exploit known vulnerabilities in the SIP protocol.

The IP sent malformed SIP requests, potentially indicating an attempt to crash the server.

Signs of Clickjacking: You might observe layered multiple HTTP requests aiming to trick users into unintended interactions.

Multi-step Attacks: Finding HTTP requests that only make sense if earlier requests succeeded or prepared the way.

The IP attempted a race condition attack, aiming to execute unwanted sequences in the server.

It launched invasive malware to corrupt crucial segments of our server functionality.

It attempted logins using outdated protocols.

It attempted to login to the SSH server with an invalid password.

The IP attempted to use the FTP server to distribute forensics tools.

It attempted to send emails with deceptive subject lines from the Mail server.

An alarming frequency of microphone loggers has been traced back to this IP.

The IP attempted to perform a Kad network amplification attack on the SSH server.

GET /administrator.php: Attempting to access an admin interface.