IP Address Overview

Automated client behavior bot Traffic patterns strongly suggest automation rather than a human-operated browser. 260923 hits 130461.50 pts

Severity	Hits	Labels	Weighted	Top labels
10	260923	1	130461.50	{'count': 260923, 'label': 'bot'}

Request size anomaly request_size Requests are unusually large or shaped in a way that suggests abuse or automation. 31379 hits 26359.32 pts

Severity	Hits	Labels	Weighted	Top labels
14	31373	1	26353.32	{'count': 31373, 'label': 'request_size'}
20	5	1	6.00	{'count': 5, 'label': 'request_size'}
0	1	1	0.00	{'count': 1, 'label': 'request_size'}

Scan velocity scan_velocity High request rate and broad endpoint coverage suggest scanning or automated enumeration. 9321 hits 10694.88 pts

Severity	Hits	Labels	Weighted	Top labels
10	5824	1	10483.20	{'count': 5824, 'label': 'scan_velocity'}
12	98	1	211.68	{'count': 98, 'label': 'scan_velocity'}
0	3399	1	0.00	{'count': 3399, 'label': 'scan_velocity'}

Credential brute forcing cred Repeated authentication attempts consistent with password guessing or credential stuffing. 422 hits 1397.00 pts

Severity	Hits	Labels	Weighted	Top labels
10	142	1	781.00	{'count': 142, 'label': 'cred'}
8	137	1	602.80	{'count': 137, 'label': 'cred'}
12	2	1	13.20	{'count': 2, 'label': 'cred'}
0	141	1	0.00	{'count': 141, 'label': 'cred'}

Command injection attempts cmdi Request content resembles attempts to execute OS commands via an application. 32 hits 748.00 pts

Severity	Hits	Labels	Weighted	Top labels
28	16	1	380.80	{'count': 16, 'label': 'cmdi'}
30	10	1	255.00	{'count': 10, 'label': 'cmdi'}
22	6	1	112.20	{'count': 6, 'label': 'cmdi'}

Sensitive file probing sfp Requests target commonly sensitive files, configs, backups, or administrative resources. 24 hits 202.40 pts

Severity	Hits	Labels	Weighted	Top labels
40	14	1	123.20	{'count': 14, 'label': 'sensitive_file'}
36	10	1	79.20	{'count': 10, 'label': 'sensitive_file'}

User-Agent anomaly ua User-Agent signals look missing, inconsistent, or indicative of non-browser tooling. 500 hits 60.00 pts

Severity	Hits	Labels	Weighted	Top labels
6	500	1	60.00	{'count': 500, 'label': 'ua'}

Firewall probing fwprobe Traffic behavior suggests probing of access controls and protected surfaces. 4 hits 47.70 pts

Severity	Hits	Labels	Weighted	Top labels
28	3	1	37.80	{'count': 3, 'label': 'fwprobe'}
22	1	1	9.90	{'count': 1, 'label': 'fwprobe'}

SQL injection attempts sqli Input patterns resemble attempts to manipulate SQL queries via application parameters. 1 hits 24.00 pts

Severity	Hits	Labels	Weighted	Top labels
24	1	1	24.00	{'count': 1, 'label': 'sqli'}

Path traversal attempts trav Request paths/parameters resemble attempts to access files outside intended directories. 1 hits 7.80 pts

Severity	Hits	Labels	Weighted	Top labels
30	1	1	7.80	{'count': 1, 'label': 'trav'}

Protocol anomaly proto Request structure or protocol-level signals deviate from typical browser HTTP traffic. 1 hits 0.96 pts

Severity	Hits	Labels	Weighted	Top labels
12	1	1	0.96	{'count': 1, 'label': 'proto'}