← Back to IP report

Log Explorer

Fact drill-down for 52.56.167.179

Risk 4 LOW Scope All time All-time facts 54 In-scope 54 Filtered 54 Seen 2023-07-25 → 2023-08-04

Freestyle query (contains)

Time (days, optional)

Page size 25 50 100 200

Apply Reset (all-time)

Active (none) Clear

Faceted filters (facts-based) exact core + snapshot + optional start/end

Annotation facets

Annotator (exact) (any) base — 36 cred — 13 fwprobe — 5 Severity (exact) (any) (none) — 41 10 — 8 30 — 5 Label (exact) (any) observed — 36 cred — 13 fwprobe — 5

HTTP facets

Method (exact, case-insensitive) (any) GET — 54 HTTP status (exact) (any) 301 — 36 404 — 14 200 — 2 302 — 2

Snapshot facets

Subnet (exact) (any) 52.56.167.0/24 — 54 ASN (exact) (any) 16509 — 54 Country / Region / City (exact)

(any country) United Kingdom — 54 (any region) England — 54

(any city) London — 54

Org contains (ip_org or as_org_name)

Custom time window (optional override)

Provide start/end to scope time explicitly (overrides days). Leave blank for all-time.

Start

End

Tip: keep windows tight when you need speed, but the default is fact-complete.

Top annotators (facts, in-scope)

base 36 cred 13 fwprobe 5

Top labels (facts, in-scope)

observed 36 cred 13 fwprobe 5

Click a pill to apply it as a filter.

Annotated access events

Showing page 1 / 2 — total 54 rows

← Prev Next →

#1 2023-08-04 11:12:06 event 134399 GET 200 bytes 12353

ann base label observed

Request event observed

/

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#2 2023-08-04 11:07:47 event 134391 GET 200 bytes 12353

ann base label observed

Request event observed

/

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#3 2023-08-04 11:05:10 event 134367 GET 404 bytes 179

ann base label observed

Request event observed

/cgi-bin/login.cgi

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/login.cgi

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#4 2023-08-04 11:02:28 event 134363 GET 404 bytes 179

ann base label observed

Request event observed

/cgi-bin/login.cgi

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/login.cgi

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#5 2023-08-04 10:59:37 event 134358 GET 404 bytes 179

ann base label observed

Request event observed

/+CSCOE+/logon.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/+CSCOE+/logon.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#6 2023-08-04 10:59:37 event 134358 GET 404 bytes 179

ann fwprobe 30 label fwprobe

Request Cisco ASA Clientless SSL-VPN portal probe (+CSCOE+)

/+CSCOE+/logon.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

fwprobe

rule

fwprobe:cisco:asa_cscoe_portal

conf

92.00

details

Request path matched a known firewall/VPN/gateway management or portal surface.

More (full fields + snapshot) expand

url

/+CSCOE+/logon.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

Cisco ASA Clientless SSL-VPN portal probe (+CSCOE+)

details

Request path matched a known firewall/VPN/gateway management or portal surface.

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#7 2023-08-04 10:56:14 event 134349 GET 404 bytes 179

ann base label observed

Request event observed

/+CSCOE+/logon.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/+CSCOE+/logon.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#8 2023-08-04 10:56:14 event 134349 GET 404 bytes 179

ann fwprobe 30 label fwprobe

Request Cisco ASA Clientless SSL-VPN portal probe (+CSCOE+)

/+CSCOE+/logon.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

fwprobe

rule

fwprobe:cisco:asa_cscoe_portal

conf

92.00

details

Request path matched a known firewall/VPN/gateway management or portal surface.

More (full fields + snapshot) expand

url

/+CSCOE+/logon.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

Cisco ASA Clientless SSL-VPN portal probe (+CSCOE+)

details

Request path matched a known firewall/VPN/gateway management or portal surface.

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#9 2023-08-04 10:52:39 event 134318 GET 404 bytes 179

ann base label observed

Request event observed

/index.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/index.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#10 2023-08-04 10:48:54 event 134317 GET 404 bytes 179

ann base label observed

Request event observed

/index.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/index.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#11 2023-08-04 10:45:35 event 134313 GET 302

ann base label observed

Request event observed

/admin/index.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/admin/index.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#12 2023-08-04 10:41:59 event 134304 GET 302

ann base label observed

Request event observed

/admin/index.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/admin/index.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#13 2023-08-04 10:38:46 event 134303 GET 404 bytes 179

ann base label observed

Request event observed

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#14 2023-08-04 10:38:46 event 134303 GET 404 bytes 179

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#15 2023-08-04 10:38:46 event 134303 GET 404 bytes 179

ann cred label cred

Request Auth endpoint request observed

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

cred

rule

cred:auth_hit:login

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#16 2023-08-04 10:35:27 event 134290 GET 404 bytes 179

ann base label observed

Request event observed

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#17 2023-08-04 10:35:27 event 134290 GET 404 bytes 179

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#18 2023-08-04 10:35:27 event 134290 GET 404 bytes 179

ann cred label cred

Request Auth endpoint request observed

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

cred

rule

cred:auth_hit:login

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#19 2023-08-04 10:33:40 event 134289 GET 301

ann base label observed

Request event observed

/favicon.ico

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/favicon.ico

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#20 2023-08-04 10:31:48 event 134285 GET 301

ann base label observed

Request event observed

/favicon.ico

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/favicon.ico

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#21 2023-08-04 10:05:21 event 134249 GET 301 bytes 169

ann base label observed

Request event observed

/

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#22 2023-08-04 10:02:17 event 134242 GET 301 bytes 169

ann base label observed

Request event observed

/cgi-bin/login.cgi

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/login.cgi

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#23 2023-08-04 09:59:04 event 134240 GET 301 bytes 169

ann base label observed

Request event observed

/+CSCOE+/logon.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/+CSCOE+/logon.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#24 2023-08-04 09:59:04 event 134240 GET 301 bytes 169

ann fwprobe 30 label fwprobe

Request Cisco ASA Clientless SSL-VPN portal probe (+CSCOE+)

/+CSCOE+/logon.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

fwprobe

rule

fwprobe:cisco:asa_cscoe_portal

conf

92.00

details

Request path matched a known firewall/VPN/gateway management or portal surface.

More (full fields + snapshot) expand

url

/+CSCOE+/logon.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

Cisco ASA Clientless SSL-VPN portal probe (+CSCOE+)

details

Request path matched a known firewall/VPN/gateway management or portal surface.

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#25 2023-08-04 09:55:42 event 134237 GET 301 bytes 169

ann base label observed

Request event observed

/index.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/index.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#26 2023-08-04 09:52:36 event 134232 GET 301 bytes 169

ann base label observed

Request event observed

/admin/index.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/admin/index.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#27 2023-08-04 09:49:24 event 134223 GET 301 bytes 169

ann base label observed

Request event observed

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#28 2023-08-04 09:49:24 event 134223 GET 301 bytes 169

ann cred 10 label cred

Request Auth redirect (301) on auth endpoint

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

cred

rule

cred:auth_redirect

conf

72.00

details

Redirect outcomes can participate in 'success-after-fails' patterns during aggregation.

More (full fields + snapshot) expand

url

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

Auth redirect (301) on auth endpoint

details

Redirect outcomes can participate in 'success-after-fails' patterns during aggregation.

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#29 2023-08-04 09:49:24 event 134223 GET 301 bytes 169

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#30 2023-08-04 09:49:24 event 134223 GET 301 bytes 169

ann cred label cred

Request Auth endpoint request observed

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

cred

rule

cred:auth_hit:login

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#31 2023-08-04 09:46:50 event 134220 GET 301 bytes 169

ann base label observed

Request event observed

/favicon.ico

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/favicon.ico

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#32 2023-07-31 10:55:55 event 42104 GET 301 bytes 169

ann base label observed

Request event observed

/

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#33 2023-07-31 10:50:41 event 42099 GET 301 bytes 169

ann base label observed

Request event observed

/cgi-bin/login.cgi

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/login.cgi

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#34 2023-07-31 10:45:18 event 42096 GET 301 bytes 169

ann base label observed

Request event observed

/+CSCOE+/logon.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/+CSCOE+/logon.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#35 2023-07-31 10:45:18 event 42096 GET 301 bytes 169

ann fwprobe 30 label fwprobe

Request Cisco ASA Clientless SSL-VPN portal probe (+CSCOE+)

/+CSCOE+/logon.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

fwprobe

rule

fwprobe:cisco:asa_cscoe_portal

conf

92.00

details

Request path matched a known firewall/VPN/gateway management or portal surface.

More (full fields + snapshot) expand

url

/+CSCOE+/logon.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

Cisco ASA Clientless SSL-VPN portal probe (+CSCOE+)

details

Request path matched a known firewall/VPN/gateway management or portal surface.

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#36 2023-07-31 10:39:26 event 42089 GET 301 bytes 169

ann base label observed

Request event observed

/index.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/index.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#37 2023-07-31 10:34:01 event 42083 GET 301 bytes 169

ann base label observed

Request event observed

/admin/index.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/admin/index.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#38 2023-07-31 10:27:51 event 42072 GET 301 bytes 169

ann base label observed

Request event observed

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#39 2023-07-31 10:27:51 event 42072 GET 301 bytes 169

ann cred 10 label cred

Request Auth redirect (301) on auth endpoint

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

cred

rule

cred:auth_redirect

conf

72.00

details

Redirect outcomes can participate in 'success-after-fails' patterns during aggregation.

More (full fields + snapshot) expand

url

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

Auth redirect (301) on auth endpoint

details

Redirect outcomes can participate in 'success-after-fails' patterns during aggregation.

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#40 2023-07-31 10:27:51 event 42072 GET 301 bytes 169

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#41 2023-07-31 10:27:51 event 42072 GET 301 bytes 169

ann cred label cred

Request Auth endpoint request observed

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

cred

rule

cred:auth_hit:login

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#42 2023-07-31 10:22:55 event 42068 GET 301 bytes 169

ann base label observed

Request event observed

/favicon.ico

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/favicon.ico

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#43 2023-07-25 11:51:38 event 54569 GET 301

ann base label observed

Request event observed

/favicon.ico

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/favicon.ico

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#44 2023-07-25 10:21:08 event 54386 GET 301 bytes 169

ann base label observed

Request event observed

/

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#45 2023-07-25 10:15:39 event 54379 GET 301 bytes 169

ann base label observed

Request event observed

/cgi-bin/login.cgi

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/login.cgi

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#46 2023-07-25 10:10:06 event 54368 GET 301 bytes 169

ann base label observed

Request event observed

/+CSCOE+/logon.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/+CSCOE+/logon.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#47 2023-07-25 10:10:06 event 54368 GET 301 bytes 169

ann fwprobe 30 label fwprobe

Request Cisco ASA Clientless SSL-VPN portal probe (+CSCOE+)

/+CSCOE+/logon.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

fwprobe

rule

fwprobe:cisco:asa_cscoe_portal

conf

92.00

details

Request path matched a known firewall/VPN/gateway management or portal surface.

More (full fields + snapshot) expand

url

/+CSCOE+/logon.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

Cisco ASA Clientless SSL-VPN portal probe (+CSCOE+)

details

Request path matched a known firewall/VPN/gateway management or portal surface.

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#48 2023-07-25 10:03:49 event 54360 GET 301 bytes 169

ann base label observed

Request event observed

/index.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/index.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#49 2023-07-25 09:58:01 event 54354 GET 301 bytes 169

ann base label observed

Request event observed

/admin/index.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/admin/index.html

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

#50 2023-07-25 09:52:55 event 54344 GET 301 bytes 169

ann base label observed

Request event observed

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/manage/account/login

referer

-

UA

'Cloud mapping experiment. Contact research@pdrlabs.net'

summary

event observed

details

—

subnet

52.56.167.0/24

asn

16509 — Amazon.com, Inc.

geo

United Kingdom, England, London

org

AWS EC2 (eu-west-2)

Page 1 of 2

← Prev Next →