This IP belongs to Sprint.

The IP was seen attempting a FTP Smurf attack, flooding the FTP server with echo request packets to cause a denial of service.

Repeated attempts to use the same password across multiple accounts.

It carried out key logging attempts, hoping to record keyboard inputs during SSH sessions.

It attempted to use the FTP server to distribute botnet command and control software.

TLS Downgrade Attacks: Logs showing repeated attempts to establish non-TLS connections with the server.

This IP had been flagged for attempting to manipulate server behaviour by injecting shellcodes.

POST /user/register: An attempt to register a new user or brute force the user registration form.

Multiple requests with identical POST parameters.

The IP made multiple unsuccessful login attempts to the POP3 server in a short period of time.

Unusual Query String Patterns: Repeated HTTP requests with minor alterations to the query string data, signifying an attacker mapping out how different inputs affect the response.

This IP belongs to Ford Motor.

This IP belongs to Allstate.

It attempted to perform a phishing attack using the POP3 server.

This malicious IP attempted a brute force attack, trying to crack login credentials to gain unauthorized access to a system or account.

The IP attempted to use the FTP server to distribute forensics tools.

The IP attempted to manipulate trusted authorities by conducting SSL strip attacks.

POST /user/register: An attempt to register a new user or brute force the user registration form.

Smuggling Attack: Logs showing a single IP initiating multiple sessions, implying a Smuggling Attack.

This IP belongs to DuPont de Nemours.

Because of numerous attacks using malicious mobile code, this IP has been blacklisted.

HEAD /: May be part of a larger Reconnaissance.

It attempted to use the SASL server to distribute malware.

This IP belongs to Marathon Petroleum.

This IP has been linked to numerous occurrences of spyware distribution within our networks.