IP Address Overview

Scan velocity scan_velocity High request rate and broad endpoint coverage suggest scanning or automated enumeration. 9144 hits 11608.20 pts

Severity	Hits	Labels	Weighted	Top labels
10	4932	1	8877.60	{'count': 4932, 'label': 'scan_velocity'}
14	334	1	841.68	{'count': 334, 'label': 'scan_velocity'}
12	293	1	632.88	{'count': 293, 'label': 'scan_velocity'}
18	135	1	437.40	{'count': 135, 'label': 'scan_velocity'}
16	105	1	302.40	{'count': 105, 'label': 'scan_velocity'}
22	56	1	221.76	{'count': 56, 'label': 'scan_velocity'}
20	59	1	212.40	{'count': 59, 'label': 'scan_velocity'}
24	9	1	38.88	{'count': 9, 'label': 'scan_velocity'}
26	6	1	28.08	{'count': 6, 'label': 'scan_velocity'}
28	3	1	15.12	{'count': 3, 'label': 'scan_velocity'}
0	3212	1	0.00	{'count': 3212, 'label': 'scan_velocity'}

Automated client behavior bot Traffic patterns strongly suggest automation rather than a human-operated browser. 21132 hits 10566.00 pts

Severity	Hits	Labels	Weighted	Top labels
10	21132	1	10566.00	{'count': 21132, 'label': 'bot'}

Sensitive file probing sfp Requests target commonly sensitive files, configs, backups, or administrative resources. 37 hits 295.68 pts

Severity	Hits	Labels	Weighted	Top labels
40	18	1	158.40	{'count': 18, 'label': 'sensitive_file'}
36	16	1	126.72	{'count': 16, 'label': 'sensitive_file'}
16	3	1	10.56	{'count': 3, 'label': 'sensitive_file'}

Command injection attempts cmdi Request content resembles attempts to execute OS commands via an application. 6 hits 141.10 pts

Severity	Hits	Labels	Weighted	Top labels
28	3	1	71.40	{'count': 3, 'label': 'cmdi'}
30	2	1	51.00	{'count': 2, 'label': 'cmdi'}
22	1	1	18.70	{'count': 1, 'label': 'cmdi'}

Credential brute forcing cred Repeated authentication attempts consistent with password guessing or credential stuffing. 27 hits 89.10 pts

Severity	Hits	Labels	Weighted	Top labels
10	9	1	49.50	{'count': 9, 'label': 'cred'}
8	9	1	39.60	{'count': 9, 'label': 'cred'}
0	9	1	0.00	{'count': 9, 'label': 'cred'}

Path traversal attempts trav Request paths/parameters resemble attempts to access files outside intended directories. 4 hits 34.32 pts

Severity	Hits	Labels	Weighted	Top labels
34	3	1	26.52	{'count': 3, 'label': 'trav'}
30	1	1	7.80	{'count': 1, 'label': 'trav'}

Header injection attempts hdrinj Input patterns suggest attempts to manipulate headers or downstream header parsing. 1 hits 19.20 pts

Severity	Hits	Labels	Weighted	Top labels
24	1	1	19.20	{'count': 1, 'label': 'hdrinj'}

Protocol anomaly proto Request structure or protocol-level signals deviate from typical browser HTTP traffic. 1 hits 1.92 pts

Severity	Hits	Labels	Weighted	Top labels
24	1	1	1.92	{'count': 1, 'label': 'proto'}

Referrer abuse ref Referrer patterns look manipulated, irrelevant, or inconsistent with normal navigation. 9 hits 1.62 pts

Severity	Hits	Labels	Weighted	Top labels
6	9	1	1.62	{'count': 9, 'label': 'ref'}

User-Agent anomaly ua User-Agent signals look missing, inconsistent, or indicative of non-browser tooling. 1 hits 0.16 pts

Severity	Hits	Labels	Weighted	Top labels
8	1	1	0.16	{'count': 1, 'label': 'ua'}