Subnet Overview

Automated client behavior bot Traffic patterns strongly suggest automation rather than a human-operated browser. 488805 hits 195522.00 pts

Severity	Hits	Labels	Weighted	Top labels
8	488805	1	195522.00	{'count': 488805, 'label': 'bot'}

Request size anomaly request_size Requests are unusually large or shaped in a way that suggests abuse or automation. 20236 hits 16998.24 pts

Severity	Hits	Labels	Weighted	Top labels
14	20236	1	16998.24	{'count': 20236, 'label': 'request_size'}

Credential brute forcing cred Repeated authentication attempts consistent with password guessing or credential stuffing. 3906 hits 12893.10 pts

Severity	Hits	Labels	Weighted	Top labels
10	1305	1	7177.50	{'count': 1305, 'label': 'cred'}
8	1290	1	5676.00	{'count': 1290, 'label': 'cred'}
12	6	1	39.60	{'count': 6, 'label': 'cred'}
0	1305	1	0.00	{'count': 1305, 'label': 'cred'}

Command injection attempts cmdi Request content resembles attempts to execute OS commands via an application. 92 hits 2154.75 pts

Severity	Hits	Labels	Weighted	Top labels
28	50	1	1190.00	{'count': 50, 'label': 'cmdi'}
30	26	1	663.00	{'count': 26, 'label': 'cmdi'}
22	15	1	280.50	{'count': 15, 'label': 'cmdi'}
25	1	1	21.25	{'count': 1, 'label': 'cmdi'}

Sensitive file probing sfp Requests target commonly sensitive files, configs, backups, or administrative resources. 248 hits 1885.40 pts

Severity	Hits	Labels	Weighted	Top labels
40	138	1	1214.40	{'count': 138, 'label': 'sensitive_file'}
24	48	1	253.44	{'count': 48, 'label': 'sensitive_file'}
36	30	1	237.60	{'count': 30, 'label': 'sensitive_file'}
34	6	1	44.88	{'count': 6, 'label': 'sensitive_file'}
16	10	1	35.20	{'count': 10, 'label': 'sensitive_file'}
22	7	1	33.88	{'count': 7, 'label': 'sensitive_file'}
30	4	1	26.40	{'count': 4, 'label': 'sensitive_file'}
44	2	1	19.36	{'count': 2, 'label': 'sensitive_file'}
42	2	1	18.48	{'count': 2, 'label': 'sensitive_file'}
8	1	1	1.76	{'count': 1, 'label': 'sensitive_file'}

Path traversal attempts trav Request paths/parameters resemble attempts to access files outside intended directories. 30 hits 247.52 pts

Severity	Hits	Labels	Weighted	Top labels
34	20	1	176.80	{'count': 20, 'label': 'trav'}
26	6	1	40.56	{'count': 6, 'label': 'trav'}
30	2	1	15.60	{'count': 2, 'label': 'trav'}
28	2	1	14.56	{'count': 2, 'label': 'trav'}

SQL injection attempts sqli Input patterns resemble attempts to manipulate SQL queries via application parameters. 5 hits 120.00 pts

Severity	Hits	Labels	Weighted	Top labels
24	3	1	72.00	{'count': 3, 'label': 'sqli'}
30	1	1	30.00	{'count': 1, 'label': 'sqli'}
18	1	1	18.00	{'count': 1, 'label': 'sqli'}

Firewall probing fwprobe Traffic behavior suggests probing of access controls and protected surfaces. 6 hits 79.20 pts

Severity	Hits	Labels	Weighted	Top labels
28	4	1	50.40	{'count': 4, 'label': 'fwprobe'}
34	1	1	15.30	{'count': 1, 'label': 'fwprobe'}
30	1	1	13.50	{'count': 1, 'label': 'fwprobe'}

Referrer abuse ref Referrer patterns look manipulated, irrelevant, or inconsistent with normal navigation. 5 hits 1.32 pts

Severity	Hits	Labels	Weighted	Top labels
9	4	1	1.08	{'count': 4, 'label': 'ref'}
8	1	1	0.24	{'count': 1, 'label': 'ref'}

Protocol anomaly proto Request structure or protocol-level signals deviate from typical browser HTTP traffic. 1 hits 0.96 pts

Severity	Hits	Labels	Weighted	Top labels
12	1	1	0.96	{'count': 1, 'label': 'proto'}