IP Address Overview

Automated client behavior bot Traffic patterns strongly suggest automation rather than a human-operated browser. 181438 hits 90719.00 pts

Severity	Hits	Labels	Weighted	Top labels
10	181438	1	90719.00	{'count': 181438, 'label': 'bot'}

Scan velocity scan_velocity High request rate and broad endpoint coverage suggest scanning or automated enumeration. 13888 hits 19140.48 pts

Severity	Hits	Labels	Weighted	Top labels
10	6113	1	11003.40	{'count': 6113, 'label': 'scan_velocity'}
14	964	1	2429.28	{'count': 964, 'label': 'scan_velocity'}
18	446	1	1445.04	{'count': 446, 'label': 'scan_velocity'}
16	377	1	1085.76	{'count': 377, 'label': 'scan_velocity'}
20	285	1	1026.00	{'count': 285, 'label': 'scan_velocity'}
12	470	1	1015.20	{'count': 470, 'label': 'scan_velocity'}
22	112	1	443.52	{'count': 112, 'label': 'scan_velocity'}
24	66	1	285.12	{'count': 66, 'label': 'scan_velocity'}
26	34	1	159.12	{'count': 34, 'label': 'scan_velocity'}
28	25	1	126.00	{'count': 25, 'label': 'scan_velocity'}
32	9	1	51.84	{'count': 9, 'label': 'scan_velocity'}
30	6	1	32.40	{'count': 6, 'label': 'scan_velocity'}
36	3	1	19.44	{'count': 3, 'label': 'scan_velocity'}
34	3	1	18.36	{'count': 3, 'label': 'scan_velocity'}
0	4975	1	0.00	{'count': 4975, 'label': 'scan_velocity'}

Sensitive file probing sfp Requests target commonly sensitive files, configs, backups, or administrative resources. 80 hits 634.48 pts

Severity	Hits	Labels	Weighted	Top labels
40	60	1	528.00	{'count': 60, 'label': 'sensitive_file'}
24	9	1	47.52	{'count': 9, 'label': 'sensitive_file'}
16	5	1	17.60	{'count': 5, 'label': 'sensitive_file'}
36	2	1	15.84	{'count': 2, 'label': 'sensitive_file'}
44	1	1	9.68	{'count': 1, 'label': 'sensitive_file'}
34	1	1	7.48	{'count': 1, 'label': 'sensitive_file'}
30	1	1	6.60	{'count': 1, 'label': 'sensitive_file'}
8	1	1	1.76	{'count': 1, 'label': 'sensitive_file'}

Credential brute forcing cred Repeated authentication attempts consistent with password guessing or credential stuffing. 34 hits 114.40 pts

Severity	Hits	Labels	Weighted	Top labels
10	14	1	77.00	{'count': 14, 'label': 'cred'}
12	5	1	33.00	{'count': 5, 'label': 'cred'}
8	1	1	4.40	{'count': 1, 'label': 'cred'}
0	14	1	0.00	{'count': 14, 'label': 'cred'}

Path traversal attempts trav Request paths/parameters resemble attempts to access files outside intended directories. 13 hits 110.76 pts

Severity	Hits	Labels	Weighted	Top labels
34	10	1	88.40	{'count': 10, 'label': 'trav'}
32	1	1	8.32	{'count': 1, 'label': 'trav'}
28	1	1	7.28	{'count': 1, 'label': 'trav'}
26	1	1	6.76	{'count': 1, 'label': 'trav'}

Command injection attempts cmdi Request content resembles attempts to execute OS commands via an application. 2 hits 49.30 pts

Severity	Hits	Labels	Weighted	Top labels
30	1	1	25.50	{'count': 1, 'label': 'cmdi'}
28	1	1	23.80	{'count': 1, 'label': 'cmdi'}

Firewall probing fwprobe Traffic behavior suggests probing of access controls and protected surfaces. 2 hits 24.30 pts

Severity	Hits	Labels	Weighted	Top labels
30	1	1	13.50	{'count': 1, 'label': 'fwprobe'}
24	1	1	10.80	{'count': 1, 'label': 'fwprobe'}

Header injection attempts hdrinj Input patterns suggest attempts to manipulate headers or downstream header parsing. 1 hits 19.20 pts

Severity	Hits	Labels	Weighted	Top labels
24	1	1	19.20	{'count': 1, 'label': 'hdrinj'}

Referrer abuse ref Referrer patterns look manipulated, irrelevant, or inconsistent with normal navigation. 3 hits 0.72 pts

Severity	Hits	Labels	Weighted	Top labels
9	2	1	0.54	{'count': 2, 'label': 'ref'}
6	1	1	0.18	{'count': 1, 'label': 'ref'}

User-Agent anomaly ua User-Agent signals look missing, inconsistent, or indicative of non-browser tooling. 4 hits 0.48 pts

Severity	Hits	Labels	Weighted	Top labels
6	4	1	0.48	{'count': 4, 'label': 'ua'}