← Back to IP report

Log Explorer

Fact drill-down for 45.156.129.123

Risk 2 LOW Scope All time All-time facts 55 In-scope 55 Filtered 55 Seen 2025-04-08 → 2025-06-26

Freestyle query (contains)

Time (days, optional)

Page size 25 50 100 200

Apply Reset (all-time)

Active (none) Clear

Faceted filters (facts-based) exact core + snapshot + optional start/end

Annotation facets

Annotator (exact) (any) base — 42 cred — 8 fwprobe — 2 ua — 2 ref — 1 Severity (exact) (any) (none) — 45 10 — 5 6 — 3 22 — 2 Label (exact) (any) observed — 42 cred — 8 fwprobe — 2 ua — 2 ref — 1

HTTP facets

Method (exact, case-insensitive) (any) GET — 55 HTTP status (exact) (any) 301 — 32 404 — 17 (none) — 4 200 — 2

Snapshot facets

Subnet (exact) (any) 45.156.129.0/24 — 55 ASN (exact) (any) 211680 — 55 Country / Region / City (exact)

(any country) United States — 55 (any region) Illinois — 55

(any city) Chicago — 55

Org contains (ip_org or as_org_name)

Custom time window (optional override)

Provide start/end to scope time explicitly (overrides days). Leave blank for all-time.

Start

End

Tip: keep windows tight when you need speed, but the default is fact-complete.

Top annotators (facts, in-scope)

base 42 cred 8 fwprobe 2 ua 2 ref 1

Top labels (facts, in-scope)

observed 42 cred 8 fwprobe 2 ua 2 ref 1

Click a pill to apply it as a filter.

Annotated access events

Showing page 1 / 2 — total 55 rows

← Prev Next →

#1 2025-06-26 06:50:32 event 11547506 GET 301 bytes 178

ann base label observed

Request event observed

/aspera/faspex/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/aspera/faspex/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#2 2025-05-16 14:58:14 event 16383465 GET 301 bytes 169

ann base label observed

Request event observed

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#3 2025-05-16 14:58:14 event 16383463 GET 301 bytes 169

ann base label observed

Request event observed

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#4 2025-05-16 14:58:14 event 16383465 GET 301 bytes 169

ann cred 10 label cred

Request Auth redirect (301) on auth endpoint

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

cred

rule

cred:auth_redirect

conf

72.00

details

Redirect outcomes can participate in 'success-after-fails' patterns during aggregation.

More (full fields + snapshot) expand

url

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

Auth redirect (301) on auth endpoint

details

Redirect outcomes can participate in 'success-after-fails' patterns during aggregation.

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#5 2025-05-16 14:58:14 event 16383465 GET 301 bytes 169

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#6 2025-05-16 14:58:14 event 16383465 GET 301 bytes 169

ann cred label cred

Request Auth endpoint request observed

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

cred

rule

cred:auth_hit:auth_other

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#7 2025-05-16 14:58:14 event 16383463 GET 301 bytes 169

ann cred 10 label cred

Request Auth redirect (301) on auth endpoint

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

cred

rule

cred:auth_redirect

conf

72.00

details

Redirect outcomes can participate in 'success-after-fails' patterns during aggregation.

More (full fields + snapshot) expand

url

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

Auth redirect (301) on auth endpoint

details

Redirect outcomes can participate in 'success-after-fails' patterns during aggregation.

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#8 2025-05-16 14:58:14 event 16383463 GET 301 bytes 169

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#9 2025-05-16 14:58:14 event 16383463 GET 301 bytes 169

ann cred label cred

Request Auth endpoint request observed

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

cred

rule

cred:auth_hit:auth_other

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#10 2025-05-16 14:57:48 event 16383365 GET 301 bytes 169

ann base label observed

Request event observed

/aspera/faspex/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/aspera/faspex/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#11 2025-05-16 14:57:48 event 16383363 GET 301 bytes 169

ann base label observed

Request event observed

/aspera/faspex/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/aspera/faspex/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#12 2025-05-16 14:57:39 event 16383320 GET 301 bytes 169

ann base label observed

Request event observed

/zabbix/favicon.ico

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/zabbix/favicon.ico

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#13 2025-05-16 14:57:39 event 16383319 GET 301 bytes 169

ann base label observed

Request event observed

/zabbix/favicon.ico

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/zabbix/favicon.ico

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#14 2025-05-16 14:55:55 event 16372942 GET 301 bytes 169

ann base label observed

Request event observed

/cgi-bin/main.pl

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/main.pl

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#15 2025-05-16 14:55:55 event 16372938 GET 301 bytes 169

ann base label observed

Request event observed

/cgi-bin/main.pl

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/main.pl

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#16 2025-05-16 14:55:30 event 16372806 GET 301 bytes 169

ann base label observed

Request event observed

/identity

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/identity

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#17 2025-05-16 14:55:30 event 16372805 GET 301 bytes 169

ann base label observed

Request event observed

/identity

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/identity

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#18 2025-05-16 14:55:29 event 16372802 GET 301 bytes 169

ann base label observed

Request event observed

/cf_scripts/scripts/ajax/ckeditor/ckeditor.js

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cf_scripts/scripts/ajax/ckeditor/ckeditor.js

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#19 2025-05-16 14:55:29 event 16372799 GET 301 bytes 169

ann base label observed

Request event observed

/cf_scripts/scripts/ajax/ckeditor/ckeditor.js

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cf_scripts/scripts/ajax/ckeditor/ckeditor.js

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#20 2025-05-16 14:55:00 event 16372677 GET 301 bytes 169

ann base label observed

Request event observed

/admin/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/admin/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#21 2025-04-08 11:04:39 event 4279144 GET 301 bytes 169

ann base label observed

Request event observed

/console

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/console

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#22 2025-04-08 11:04:31 event 4279130 GET 404 bytes 7892

ann base label observed

Request event observed

/showLogin.cc

referer

http://139.59.53.236/showLogin.cc

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/showLogin.cc

referer

http://139.59.53.236/showLogin.cc

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#23 2025-04-08 11:04:29 event 4279121 GET 301 bytes 169

ann base label observed

Request event observed

/admin/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/admin/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#24 2025-04-08 11:04:22 event 4279111 GET 404 bytes 7896

ann base label observed

Request event observed

/wp-json

referer

http://139.59.53.236/wp-json

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/wp-json

referer

http://139.59.53.236/wp-json

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#25 2025-04-08 11:03:51 event 4279075 GET 404 bytes 7894

ann base label observed

Request event observed

/zabbix/favicon.ico

referer

http://139.59.53.236/zabbix/favicon.ico

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/zabbix/favicon.ico

referer

http://139.59.53.236/zabbix/favicon.ico

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#26 2025-04-08 11:03:32 event 4279052 GET 404 bytes 7896

ann base label observed

Request event observed

/helpdesk/WebObjects/Helpdesk.woa

referer

http://139.59.53.236/helpdesk/WebObjects/Helpdesk.woa

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/helpdesk/WebObjects/Helpdesk.woa

referer

http://139.59.53.236/helpdesk/WebObjects/Helpdesk.woa

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#27 2025-04-08 11:03:21 event 4279042 GET 404 bytes 7898

ann base label observed

Request event observed

/sitecore/shell/sitecore.version.xml

referer

http://139.59.53.236/sitecore/shell/sitecore.version.xml

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/sitecore/shell/sitecore.version.xml

referer

http://139.59.53.236/sitecore/shell/sitecore.version.xml

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#28 2025-04-08 11:03:02 event 4279024 GET 404 bytes 7896

ann base label observed

Request event observed

/status.php

referer

http://139.59.53.236/status.php

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/status.php

referer

http://139.59.53.236/status.php

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#29 2025-04-08 11:03:02 event 4279022 GET 301 bytes 169

ann base label observed

Request event observed

/status.php

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/status.php

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#30 2025-04-08 11:03:02 event 4279024 GET 404 bytes 7896

ann fwprobe 22 label fwprobe

Request pfSense/OPNsense admin UI probe

/status.php

referer

http://139.59.53.236/status.php

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

fwprobe

rule

fwprobe:pfsense:ui_probe

conf

80.00

details

Request path matched a known firewall/VPN/gateway management or portal surface.

More (full fields + snapshot) expand

url

/status.php

referer

http://139.59.53.236/status.php

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

pfSense/OPNsense admin UI probe

details

Request path matched a known firewall/VPN/gateway management or portal surface.

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#31 2025-04-08 11:03:02 event 4279022 GET 301 bytes 169

ann fwprobe 22 label fwprobe

Request pfSense/OPNsense admin UI probe

/status.php

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

fwprobe

rule

fwprobe:pfsense:ui_probe

conf

80.00

details

Request path matched a known firewall/VPN/gateway management or portal surface.

More (full fields + snapshot) expand

url

/status.php

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

pfSense/OPNsense admin UI probe

details

Request path matched a known firewall/VPN/gateway management or portal surface.

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#32 2025-04-08 11:02:49 event 4278992 GET 301 bytes 169

ann base label observed

Request event observed

/owncloud/status.php

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/owncloud/status.php

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#33 2025-04-08 11:02:38 event 4278980 GET 301 bytes 169

ann base label observed

Request event observed

/WebInterface/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/WebInterface/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#34 2025-04-08 11:02:35 event 4278972 GET 301 bytes 169

ann base label observed

Request event observed

/xmldata?item=all

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/xmldata?item=all

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#35 2025-04-08 11:02:23 event 4278955 GET 404 bytes 7896

ann base label observed

Request event observed

/partymgr/control/main

referer

http://139.59.53.236/partymgr/control/main

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/partymgr/control/main

referer

http://139.59.53.236/partymgr/control/main

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#36 2025-04-08 11:02:04 event 4278928 GET 301 bytes 169

ann base label observed

Request event observed

/login.do

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/login.do

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#37 2025-04-08 11:01:29 event 4278896 GET 200 bytes 1300

ann base label observed

Request event observed

/static/img/favicon.ico

referer

https://139.59.53.236/favicon.ico

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/static/img/favicon.ico

referer

https://139.59.53.236/favicon.ico

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#38 2025-04-08 11:01:28 event 4278895 GET 301

ann base label observed

Request event observed

/favicon.ico

referer

http://139.59.53.236/favicon.ico

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/favicon.ico

referer

http://139.59.53.236/favicon.ico

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#39 2025-04-08 11:01:28 event 4278893 GET 301 bytes 169

ann base label observed

Request event observed

/favicon.ico

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/favicon.ico

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#40 2025-04-08 11:01:13 event 4278884 GET 404 bytes 7897

ann ref 6 label ref

Request External referer observed on an auth-like endpoint

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

ref

rule

ref:external_referer_to_auth

conf

70.00

details

External origins hitting login/auth endpoints can be a signal of phishing landing pages or malicious redirect chains. This is only emitted for auth-like paths.

More (full fields + snapshot) expand

url

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

External referer observed on an auth-like endpoint

details

External origins hitting login/auth endpoints can be a signal of phishing landing pages or malicious redirect chains. This is only emitted for auth-like paths.

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#41 2025-04-08 11:01:13 event 4278884 GET 404 bytes 7897

ann base label observed

Request event observed

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#42 2025-04-08 11:01:13 event 4278884 GET 404 bytes 7897

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#43 2025-04-08 11:01:13 event 4278884 GET 404 bytes 7897

ann cred label cred

Request Auth endpoint request observed

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

cred

rule

cred:auth_hit:auth_other

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#44 2025-04-08 11:00:55 event 4278862 GET 301 bytes 169

ann base label observed

Request event observed

/webfig/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/webfig/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#45 2025-04-08 11:00:55 event 4278861 GET 301 bytes 169

ann base label observed

Request event observed

/webfig/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/webfig/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#46 2025-04-08 11:00:39 event 4278839 GET 404 bytes 7897

ann base label observed

Request event observed

/internal_forms_authentication

referer

http://139.59.53.236/internal_forms_authentication

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/internal_forms_authentication

referer

http://139.59.53.236/internal_forms_authentication

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#47 2025-04-08 11:00:39 event 4278837 GET 404 bytes 7897

ann base label observed

Request event observed

/internal_forms_authentication

referer

http://139.59.53.236/internal_forms_authentication

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/internal_forms_authentication

referer

http://139.59.53.236/internal_forms_authentication

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#48 2025-04-08 11:00:19 event 4278807 GET http —

ann ua 6 label ua

Request Missing User-Agent header

/static/historypage.js

referer

—

UA

—

Annotation facts

label

ua

rule

ua:missing

conf

60.00

details

Request had no User-Agent value (missing/empty field).

More (full fields + snapshot) expand

url

/static/historypage.js

referer

—

UA

—

summary

Missing User-Agent header

details

Request had no User-Agent value (missing/empty field).

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#49 2025-04-08 11:00:19 event 4278805 GET http —

ann ua 6 label ua

Request Missing User-Agent header

/static/historypage.js

referer

—

UA

—

Annotation facts

label

ua

rule

ua:missing

conf

60.00

details

Request had no User-Agent value (missing/empty field).

More (full fields + snapshot) expand

url

/static/historypage.js

referer

—

UA

—

summary

Missing User-Agent header

details

Request had no User-Agent value (missing/empty field).

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

#50 2025-04-08 11:00:19 event 4278808 GET 404 bytes 184

ann base label observed

Request event observed

/static/historypage.js

referer

http://139.59.53.236/static/historypage.js

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/static/historypage.js

referer

http://139.59.53.236/static/historypage.js

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

Page 1 of 2

← Prev Next →