Decision for 209.38.208.202

Reasons

• High severity exploit activity was observed, but only from a single node.
• Multiple stages of an attack chain were observed within a short time window.
• Further attacks within a short window, permanent ban applied based on indicators of persistence attacks.

MITRE ATT&CK Mappings

• Tactics: Initial Access, Reconnaissance
• Techniques: T1190, T1595

Evidence

• Nodes observed: 1
• Severity: CRITICAL
• TTL remaining: 4d 22h