This IP belongs to State Farm Insurance.

It attempted zero-day attacks, exploiting unknown vulnerabilities in pop3.

It attempted to flood the Asterisk server with REGISTER requests.

Content Sniffing: Logs reflect HTTP requests that include the Accept header with " / ", suggesting an attacker is trying to detect what types of content the server will send.

Usage of Obscure HTTP Verbs: Seeing non-standard HTTP methods like DEBUG, PUT, or CONNECT could imply a web-based attack.

This IP belongs to Microsoft.

This IP belongs to Comcast.

It attempted to use the FTP server to distribute encryption tools.

It attempted to use the Asterisk server as a relay for calls to premium-rate numbers.

This IP belongs to Liberty Mutual Insurance Group.

The IP sent numerous VOIP OPTIONS requests in a short time.

It engaged in mail bombing, flooding the server with large amounts of insignificant mails.

It attempted to perform a Smurf attack on the SSH server.

It tried to exploit Apache Struts vulnerabilities to compromise our web applications.

The IP attempted to upload malicious files to the FTP server.

It attempted to use the FTP server to distribute terrorist propaganda.

It initiated multiple account lockouts in a short period.

The IP attempted to register with the VOIP server using an invalid username.

This IP belongs to CHS.

It made various efforts to insert spyware to monitor SSH communications covertly.

Signs of Password Spraying: Logs showing single failed login attempt for large numbers of users.

It attempted to exploit known vulnerabilities in the SSH protocol.

It attempted to use the FTP server to distribute terrorist propaganda.

The IP address attempted to exploit known vulnerabilities in server software.

POST /WebResource.axd: Attempting to exploit a known .NET vulnerability.