Subnet Overview

Sensitive file probing sfp Requests target commonly sensitive files, configs, backups, or administrative resources. 22871 hits 182417.84 pts

Severity	Hits	Labels	Weighted	Top labels
40	17268	1	151958.40	{'count': 17268, 'label': 'sensitive_file'}
24	2477	1	13078.56	{'count': 2477, 'label': 'sensitive_file'}
16	1495	1	5262.40	{'count': 1495, 'label': 'sensitive_file'}
34	623	1	4660.04	{'count': 623, 'label': 'sensitive_file'}
36	526	1	4165.92	{'count': 526, 'label': 'sensitive_file'}
44	141	1	1364.88	{'count': 141, 'label': 'sensitive_file'}
22	140	1	677.60	{'count': 140, 'label': 'sensitive_file'}
42	70	1	646.80	{'count': 70, 'label': 'sensitive_file'}
30	77	1	508.20	{'count': 77, 'label': 'sensitive_file'}
8	54	1	95.04	{'count': 54, 'label': 'sensitive_file'}

Scan velocity scan_velocity High request rate and broad endpoint coverage suggest scanning or automated enumeration. 5567 hits 24268.68 pts

Severity	Hits	Labels	Weighted	Top labels
36	2304	1	14929.92	{'count': 2304, 'label': 'scan_velocity'}
34	396	1	2423.52	{'count': 396, 'label': 'scan_velocity'}
28	291	1	1466.64	{'count': 291, 'label': 'scan_velocity'}
24	290	1	1252.80	{'count': 290, 'label': 'scan_velocity'}
26	226	1	1057.68	{'count': 226, 'label': 'scan_velocity'}
32	163	1	938.88	{'count': 163, 'label': 'scan_velocity'}
22	189	1	748.44	{'count': 189, 'label': 'scan_velocity'}
30	102	1	550.80	{'count': 102, 'label': 'scan_velocity'}
20	91	1	327.60	{'count': 91, 'label': 'scan_velocity'}
18	67	1	217.08	{'count': 67, 'label': 'scan_velocity'}
16	52	1	149.76	{'count': 52, 'label': 'scan_velocity'}
14	42	1	105.84	{'count': 42, 'label': 'scan_velocity'}
12	32	1	69.12	{'count': 32, 'label': 'scan_velocity'}
10	17	1	30.60	{'count': 17, 'label': 'scan_velocity'}
0	1305	1	0.00	{'count': 1305, 'label': 'scan_velocity'}

Command injection attempts cmdi Request content resembles attempts to execute OS commands via an application. 741 hits 18892.10 pts

Severity	Hits	Labels	Weighted	Top labels
30	739	1	18844.50	{'count': 739, 'label': 'cmdi'}
28	2	1	47.60	{'count': 2, 'label': 'cmdi'}

User-Agent anomaly ua User-Agent signals look missing, inconsistent, or indicative of non-browser tooling. 59885 hits 16709.88 pts

Severity	Hits	Labels	Weighted	Top labels
14	59318	1	16609.04	{'count': 59318, 'label': 'ua'}
10	261	1	52.20	{'count': 261, 'label': 'ua'}
8	298	1	47.68	{'count': 298, 'label': 'ua'}
6	8	1	0.96	{'count': 8, 'label': 'ua'}

Path traversal attempts trav Request paths/parameters resemble attempts to access files outside intended directories. 1334 hits 11188.32 pts

Severity	Hits	Labels	Weighted	Top labels
34	1017	1	8990.28	{'count': 1017, 'label': 'trav'}
26	212	1	1433.12	{'count': 212, 'label': 'trav'}
28	104	1	757.12	{'count': 104, 'label': 'trav'}
30	1	1	7.80	{'count': 1, 'label': 'trav'}

Credential brute forcing cred Repeated authentication attempts consistent with password guessing or credential stuffing. 2193 hits 6637.40 pts

Severity	Hits	Labels	Weighted	Top labels
10	924	1	5082.00	{'count': 924, 'label': 'cred'}
8	331	1	1456.40	{'count': 331, 'label': 'cred'}
12	15	1	99.00	{'count': 15, 'label': 'cred'}
0	923	1	0.00	{'count': 923, 'label': 'cred'}

Protocol anomaly proto Request structure or protocol-level signals deviate from typical browser HTTP traffic. 90 hits 147.84 pts

Severity	Hits	Labels	Weighted	Top labels
24	64	1	122.88	{'count': 64, 'label': 'proto'}
12	26	1	24.96	{'count': 26, 'label': 'proto'}

Firewall probing fwprobe Traffic behavior suggests probing of access controls and protected surfaces. 3 hits 29.70 pts

Severity	Hits	Labels	Weighted	Top labels
22	3	1	29.70	{'count': 3, 'label': 'fwprobe'}

General injection attempts injg Suspicious input patterns consistent with injection-like probing across multiple families. 1 hits 20.30 pts

Severity	Hits	Labels	Weighted	Top labels
29	1	1	20.30	{'count': 1, 'label': 'injg'}

HTTP method anomaly method Unusual or unexpected HTTP methods observed for the target endpoints. 6 hits 3.60 pts

Severity	Hits	Labels	Weighted	Top labels
10	6	1	3.60	{'count': 6, 'label': 'method'}

Referrer abuse ref Referrer patterns look manipulated, irrelevant, or inconsistent with normal navigation. 12 hits 2.79 pts

Severity	Hits	Labels	Weighted	Top labels
9	7	1	1.89	{'count': 7, 'label': 'ref'}
6	5	1	0.90	{'count': 5, 'label': 'ref'}

Request size anomaly request_size Requests are unusually large or shaped in a way that suggests abuse or automation. 2 hits 1.44 pts

Severity	Hits	Labels	Weighted	Top labels
12	2	1	1.44	{'count': 2, 'label': 'request_size'}