High-level context about this subnet: size, density, traffic, risk, and geographic footprint.
sqli, cmdi, trav, sfp, bot).
Daily activity (hits per day) plus HTTP response mix and basic counters from the subnet traffic rollup.
Heatmap of annotator × severity for this subnet. Darker cells mean more volume in that band. Tip: switch to Weighted points to see what drives impact (not just noise).
| Severity | Total | Labels | Weighted | Top labels |
|---|---|---|---|---|
| 10 | 3500 | 1 | 6300.00 |
scan_velocity 3500
|
| 12 | 78 | 1 | 168.48 |
scan_velocity 78
|
| 16 | 52 | 1 | 149.76 |
scan_velocity 52
|
| 14 | 35 | 1 | 88.20 |
scan_velocity 35
|
| 0 | 3635 | 1 | 0.00 |
scan_velocity 3635
|
| Severity | Total | Labels | Weighted | Top labels |
|---|---|---|---|---|
| 12 | 5634 | 1 | 4056.48 |
request_size 5634
|
| 14 | 1277 | 1 | 1072.68 |
request_size 1277
|
| 20 | 95 | 1 | 114.00 |
request_size 95
|
| 0 | 3767 | 1 | 0.00 |
request_size 3767
|
| Severity | Total | Labels | Weighted | Top labels |
|---|---|---|---|---|
| 10 | 674 | 1 | 3707.00 |
cred 674
|
| 8 | 290 | 1 | 1276.00 |
cred 290
|
| 6 | 10 | 1 | 33.00 |
cred 10
|
| 14 | 3 | 1 | 23.10 |
cred 3
|
| 0 | 501 | 1 | 0.00 |
cred 501
|
| Severity | Total | Labels | Weighted | Top labels |
|---|---|---|---|---|
| 6 | 12523 | 1 | 1502.76 |
ua 12523
|
| 14 | 6 | 1 | 1.68 |
ua 6
|
| Severity | Total | Labels | Weighted | Top labels |
|---|---|---|---|---|
| 30 | 6 | 1 | 153.00 |
cmdi 6
|
| 28 | 6 | 1 | 142.80 |
cmdi 6
|
| 22 | 6 | 1 | 112.20 |
cmdi 6
|
| Severity | Total | Labels | Weighted | Top labels |
|---|---|---|---|---|
| 6 | 445 | 1 | 80.10 |
ref 445
|
| Severity | Total | Labels | Weighted | Top labels |
|---|---|---|---|---|
| 20 | 3 | 1 | 60.00 |
sqli 3
|
| Severity | Total | Labels | Weighted | Top labels |
|---|---|---|---|---|
| 10 | 64 | 1 | 32.00 |
bot 64
|
| Severity | Total | Labels | Weighted | Top labels |
|---|---|---|---|---|
| 40 | 1 | 1 | 8.80 |
sensitive_file 1
|
Response mix grouped by status class (2xx/3xx/4xx/5xx). Auto-loads one aggregation and renders a donut.
Live geolocation and map tiles auto-load for this subnet (all IPs with coordinates).
Top risky peers inside this subnet (latest snapshot). Sorted by risk score, then hits.
Compares other subnet snapshots matching this report’s ASN/org identity. “Same window” keeps the comparison within the latest snapshot window.