because they're one of the largest global networks on the planet and they have detected potential misuse or behavior they believe is related to a larger incident. or you're indiscriminately strobing subnets with nmap or something else you aren't authorized to do.