This IP belongs to Fannie Mae.

Multiple attempts to access the server using encrypted tunnels or proxies.

Multiple attempts to access the server using anonymous or generic user accounts.

It was found that the IP has been exploiting zero-day vulnerabilities in our system.

It attempted logins using outdated protocols.

This IP belongs to Vkontakte.

It showed unusual activity in the server's error logs.

The IP attempted to perform a Fraggle attack on the SSH server.

This IP belongs to Dropbox.

GET /manager/html: Signals an attempt to access the Tomcat Application Manager.

It made numerous requests to the same endpoint in a short time.

This IP belongs to Fannie Mae.

The IP address attempted to stealthily spread screen scrapers, programs that take screenshots of the user's display.

The IP attempted to perform a VOIP Hopper scan on the VOIP server.

It attempted to perform a VOIP Hopper scan on the Asterisk server.

The IP attempted to perform a Nestea attack on the SSH server.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

Multiple Sequential Page Requests: Quick, sequential requests to all pages of a site could be someone scanning for vulnerabilities.

This IP belongs to Pinterest.

The IP attempted to perform SOAP Injection attacks on the Apache server.

The IP made repeated attempts to authenticate with the Asterisk server using different usernames.

It attempted to perform a Quake Network Protocol amplification attack on the SSH server.

The IP was actively seeking unpatched SSH software in hope of finding exploitable vulnerabilities.

This IP belongs to McKesson.

Path/File Enumeration: Logs show multiple HTTP requests to non-existing pages and incrementing filenames, suggesting file or path enumeration.