IP Address Overview

Automated client behavior bot Traffic patterns strongly suggest automation rather than a human-operated browser. 347596 hits 139038.40 pts

Severity	Hits	Labels	Weighted	Top labels
8	347596	1	139038.40	{'count': 347596, 'label': 'bot'}

Sensitive file probing sfp Requests target commonly sensitive files, configs, backups, or administrative resources. 876 hits 6669.96 pts

Severity	Hits	Labels	Weighted	Top labels
40	543	1	4778.40	{'count': 543, 'label': 'sensitive_file'}
24	214	1	1129.92	{'count': 214, 'label': 'sensitive_file'}
36	36	1	285.12	{'count': 36, 'label': 'sensitive_file'}
34	17	1	127.16	{'count': 17, 'label': 'sensitive_file'}
22	23	1	111.32	{'count': 23, 'label': 'sensitive_file'}
16	28	1	98.56	{'count': 28, 'label': 'sensitive_file'}
44	8	1	77.44	{'count': 8, 'label': 'sensitive_file'}
42	6	1	55.44	{'count': 6, 'label': 'sensitive_file'}
30	1	1	6.60	{'count': 1, 'label': 'sensitive_file'}

Scan velocity scan_velocity High request rate and broad endpoint coverage suggest scanning or automated enumeration. 5156 hits 6597.00 pts

Severity	Hits	Labels	Weighted	Top labels
10	1341	1	2413.80	{'count': 1341, 'label': 'scan_velocity'}
12	667	1	1440.72	{'count': 667, 'label': 'scan_velocity'}
22	338	1	1338.48	{'count': 338, 'label': 'scan_velocity'}
20	120	1	432.00	{'count': 120, 'label': 'scan_velocity'}
18	124	1	401.76	{'count': 124, 'label': 'scan_velocity'}
16	100	1	288.00	{'count': 100, 'label': 'scan_velocity'}
14	112	1	282.24	{'count': 112, 'label': 'scan_velocity'}
0	2354	1	0.00	{'count': 2354, 'label': 'scan_velocity'}

Path traversal attempts trav Request paths/parameters resemble attempts to access files outside intended directories. 125 hits 1062.88 pts

Severity	Hits	Labels	Weighted	Top labels
34	103	1	910.52	{'count': 103, 'label': 'trav'}
26	16	1	108.16	{'count': 16, 'label': 'trav'}
28	5	1	36.40	{'count': 5, 'label': 'trav'}
30	1	1	7.80	{'count': 1, 'label': 'trav'}

Credential brute forcing cred Repeated authentication attempts consistent with password guessing or credential stuffing. 211 hits 744.70 pts

Severity	Hits	Labels	Weighted	Top labels
10	81	1	445.50	{'count': 81, 'label': 'cred'}
12	38	1	250.80	{'count': 38, 'label': 'cred'}
8	11	1	48.40	{'count': 11, 'label': 'cred'}
0	81	1	0.00	{'count': 81, 'label': 'cred'}

Firewall probing fwprobe Traffic behavior suggests probing of access controls and protected surfaces. 15 hits 189.90 pts

Severity	Hits	Labels	Weighted	Top labels
28	6	1	75.60	{'count': 6, 'label': 'fwprobe'}
32	3	1	43.20	{'count': 3, 'label': 'fwprobe'}
22	2	1	19.80	{'count': 2, 'label': 'fwprobe'}
34	1	1	15.30	{'count': 1, 'label': 'fwprobe'}
30	1	1	13.50	{'count': 1, 'label': 'fwprobe'}
26	1	1	11.70	{'count': 1, 'label': 'fwprobe'}
24	1	1	10.80	{'count': 1, 'label': 'fwprobe'}

Command injection attempts cmdi Request content resembles attempts to execute OS commands via an application. 7 hits 175.10 pts

Severity	Hits	Labels	Weighted	Top labels
30	5	1	127.50	{'count': 5, 'label': 'cmdi'}
28	2	1	47.60	{'count': 2, 'label': 'cmdi'}

Header injection attempts hdrinj Input patterns suggest attempts to manipulate headers or downstream header parsing. 2 hits 38.40 pts

Severity	Hits	Labels	Weighted	Top labels
24	2	1	38.40	{'count': 2, 'label': 'hdrinj'}

Request size anomaly request_size Requests are unusually large or shaped in a way that suggests abuse or automation. 1 hits 0.84 pts

Severity	Hits	Labels	Weighted	Top labels
14	1	1	0.84	{'count': 1, 'label': 'request_size'}

User-Agent anomaly ua User-Agent signals look missing, inconsistent, or indicative of non-browser tooling. 2 hits 0.32 pts

Severity	Hits	Labels	Weighted	Top labels
8	2	1	0.32	{'count': 2, 'label': 'ua'}