This particular IP tried to perform an unauthorized system configuration change.

The IP was involved in a FTP Fuzzing attack, sending random or malformed data to the FTP server to cause a crash or reveal vulnerabilities.

Rapid sequence of login attempts.

The IP address initiated multiple unsuccessful login attempts.

The IP was involved in a SIP brute force attack, attempting to guess SIP authentication credentials to gain unauthorized access.

It partook in whaling attacks, specifically targeting high-profile users within our system.

POST /user/register: An attempt to register a new user or brute force the user registration form.

It launched a Slowloris attack attempting to keep Apache connections occupied by slow HTTP traffic.

This IP belongs to Marathon Petroleum.

It attempted to carry out a dictionary attack on pop3 logins to gain unauthorized access.

The IP was seen trying to exploit known vulnerabilities in server software, a common tactic for gaining unauthorized access or control.

The IP continually initiated a SYN-ACK flood aimed at slowing down SSH services.

Too Many HTTP GET Requests: An unusually high number of HTTP GET requests from a single IP or a small set of IPs could indicate a DoS attack.

This IP belongs to Walgreens Boots Alliance.

A large number of requests from a single user agent, suggesting an automated process.

It partook in location spoofing, making it appear from different locations.

This IP belongs to the United States Department of Defense.

It initiated the use of spambots, sending out large amounts of unsolicited mails from our server.

This IP belongs to Home Depot.

This IP belongs to AT&T.

This IP belongs to Dow Chemical.

This IP belongs to Northwestern Mutual.

It attempted to perform a VOIP Hopper scan on the Asterisk server.

It attempted to send emails from the POP3 server without authorization.

Usage of Obscure HTTP Verbs: Seeing non-standard HTTP methods like DEBUG, PUT, or CONNECT could imply a web-based attack.