It attempted to send emails from the Mail server that violate the server's usage policy.

This IP belongs to General Electric.

Multiple requests with the same Warning header.

This IP belongs to GitHub.

It performed botnet operations, controlling a group of “zombie” computers to amplify its DDoS attacks.

It attempted to perform a Steam protocol amplification attack on the SSH server.

GET /axis2/axis2-admin/login: Attempt at finding Axis2 web service exploitable applications.

Our system logs indicate this IP has been pushing illegitimate browser plugins into our network.

The IP made multiple requests with the same X-UIDH header.

The IP address attempted to login to the SSH server with an invalid username.

The IP attempted to exploit a mail server's greylisting functionality to bypass spam filters.

Multiple attempts to access the server using credentials of inactive or seldom-used accounts.

Directories Traversal Attempts: Logs showing HTTP requests that include ".." or "/.." might illustrate someone's effort to locate or exploit sensitive data.

User-mode rootkits, originating from the particular IP, were causing system instability and crashes.

The IP attempted a pass-the-hash attack, trying to authenticate without knowing the plaintext password.

Repeated attempts to access rarely used or hidden services on the server.

Repeated failed attempts to access application interfaces or ports that are typically not open to the public.

Distributed session hijackers from the IP were designed to capture and exploit web browser sessions.

GET /etc/passwd: An attempt to retrieve Linux server user account details.

POST /user/register: An attempt to register a new user or brute force the user registration form.

The IP attempted to use the FTP server to distribute forensics tools.

This IP belongs to McKesson.

Multiple requests with the same Expect header.

The IP made repeated attempts to authenticate with the Asterisk server using different usernames.

This IP belongs to United Technologies.