← Back to IP report

Log Explorer

Fact drill-down for 45.156.129.113

Risk 2 LOW Scope All time All-time facts 62 In-scope 62 Filtered 62 Seen 2024-09-17 → 2025-02-27

Freestyle query (contains)

Time (days, optional)

Page size 25 50 100 200

Apply Reset (all-time)

Active (none) Clear

Faceted filters (facts-based) exact core + snapshot + optional start/end

Annotation facets

Annotator (exact) (any) base — 45 cred — 13 ref — 2 ua — 2 Severity (exact) (any) (none) — 50 10 — 8 6 — 4 Label (exact) (any) observed — 45 cred — 13 ref — 2 ua — 2

HTTP facets

Method (exact, case-insensitive) (any) GET — 62 HTTP status (exact) (any) 301 — 30 404 — 25 (none) — 4 200 — 3

Snapshot facets

Subnet (exact) (any) 45.156.129.0/24 — 62 ASN (exact) (any) 211680 — 62 Country / Region / City (exact)

(any country) United States — 62 (any region) Illinois — 62

(any city) Chicago — 62

Org contains (ip_org or as_org_name)

Custom time window (optional override)

Provide start/end to scope time explicitly (overrides days). Leave blank for all-time.

Start

End

Tip: keep windows tight when you need speed, but the default is fact-complete.

Top annotators (facts, in-scope)

base 45 cred 13 ref 2 ua 2

Top labels (facts, in-scope)

observed 45 cred 13 ref 2 ua 2

Click a pill to apply it as a filter.

Annotated access events

Showing page 1 / 2 — total 62 rows

← Prev Next →

# 2025-02-27 07:14:26 event 3425694 GET 404 bytes 7900

ann base label observed

Request event observed

/owncloud/status.php

referer

http://68.183.80.204/owncloud/status.php

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/owncloud/status.php

referer

http://68.183.80.204/owncloud/status.php

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-27 07:13:58 event 3425690 GET 404 bytes 7899

ann base label observed

Request event observed

/showLogin.cc

referer

http://68.183.80.204/showLogin.cc

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/showLogin.cc

referer

http://68.183.80.204/showLogin.cc

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-27 07:13:28 event 3425684 GET 301 bytes 169

ann base label observed

Request event observed

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-27 07:13:28 event 3425684 GET 301 bytes 169

ann cred 10 label cred

Request Auth redirect (301) on auth endpoint

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

cred

rule

cred:auth_redirect

conf

72.00

details

Redirect outcomes can participate in 'success-after-fails' patterns during aggregation.

More (full fields + snapshot) expand

url

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

Auth redirect (301) on auth endpoint

details

Redirect outcomes can participate in 'success-after-fails' patterns during aggregation.

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-27 07:13:28 event 3425684 GET 301 bytes 169

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-27 07:13:28 event 3425684 GET 301 bytes 169

ann cred label cred

Request Auth endpoint request observed

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

cred

rule

cred:auth_hit:auth_other

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-27 07:12:17 event 3425665 GET 301 bytes 169

ann base label observed

Request event observed

/OA_HTML/AppsLocalLogin.jsp

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/OA_HTML/AppsLocalLogin.jsp

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-27 07:12:16 event 3425664 GET 301 bytes 169

ann base label observed

Request event observed

/cf_scripts/scripts/ajax/ckeditor/ckeditor.js

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cf_scripts/scripts/ajax/ckeditor/ckeditor.js

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-27 07:11:14 event 3425645 GET 301 bytes 169

ann base label observed

Request event observed

/wp-json

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/wp-json

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-27 07:10:57 event 3425639 GET 200 bytes 7202

ann base label observed

Request event observed

/

referer

http://68.183.80.204/

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

http://68.183.80.204/

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-27 07:10:38 event 3425635 GET 404 bytes 7898

ann base label observed

Request event observed

/js/NewWindow_2_all.js

referer

http://68.183.80.204/js/NewWindow_2_all.js

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/js/NewWindow_2_all.js

referer

http://68.183.80.204/js/NewWindow_2_all.js

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-27 07:10:15 event 3425630 GET 404 bytes 7898

ann base label observed

Request event observed

/cgi-bin/authLogin.cgi

referer

http://68.183.80.204/cgi-bin/authLogin.cgi

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/authLogin.cgi

referer

http://68.183.80.204/cgi-bin/authLogin.cgi

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-27 07:10:14 event 3425628 GET 301 bytes 169

ann base label observed

Request event observed

/cgi-bin/authLogin.cgi

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/cgi-bin/authLogin.cgi

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-27 07:10:13 event 3425627 GET 301 bytes 169

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-27 07:09:28 event 3425624 GET 404 bytes 7899

ann base label observed

Request event observed

/Telerik.Web.UI.WebResource.axd?type=rau

referer

http://68.183.80.204/Telerik.Web.UI.WebResource.axd?type=rau

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/Telerik.Web.UI.WebResource.axd?type=rau

referer

http://68.183.80.204/Telerik.Web.UI.WebResource.axd?type=rau

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-27 07:09:08 event 3425620 GET 301 bytes 169

ann base label observed

Request event observed

/solr/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/solr/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-27 07:08:50 event 3425616 GET 301 bytes 169

ann base label observed

Request event observed

/favicon.ico

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/favicon.ico

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:08:23 event 2949033 GET 301 bytes 169

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:08:23 event 2949031 GET 301 bytes 169

ann base label observed

Request event observed

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:08:15 event 2949017 GET 301 bytes 169

ann base label observed

Request event observed

/WebInterface/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/WebInterface/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:08:15 event 2949016 GET 301 bytes 169

ann base label observed

Request event observed

/WebInterface/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/WebInterface/

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:06:57 event 2948973 GET 404 bytes 7897

ann base label observed

Request event observed

/identity

referer

http://139.59.53.236/identity

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/identity

referer

http://139.59.53.236/identity

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:06:57 event 2948972 GET 404 bytes 7897

ann base label observed

Request event observed

/identity

referer

http://139.59.53.236/identity

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/identity

referer

http://139.59.53.236/identity

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:06:41 event 2948961 GET 404 bytes 7900

ann base label observed

Request event observed

/OA_HTML/AppsLocalLogin.jsp

referer

http://139.59.53.236/OA_HTML/AppsLocalLogin.jsp

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/OA_HTML/AppsLocalLogin.jsp

referer

http://139.59.53.236/OA_HTML/AppsLocalLogin.jsp

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:06:41 event 2948960 GET 404 bytes 7900

ann base label observed

Request event observed

/OA_HTML/AppsLocalLogin.jsp

referer

http://139.59.53.236/OA_HTML/AppsLocalLogin.jsp

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/OA_HTML/AppsLocalLogin.jsp

referer

http://139.59.53.236/OA_HTML/AppsLocalLogin.jsp

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:06:13 event 2948949 GET 404 bytes 7901

ann base label observed

Request event observed

/sugar_version.json

referer

http://139.59.53.236/sugar_version.json

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/sugar_version.json

referer

http://139.59.53.236/sugar_version.json

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:06:13 event 2948948 GET 404 bytes 7901

ann base label observed

Request event observed

/sugar_version.json

referer

http://139.59.53.236/sugar_version.json

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/sugar_version.json

referer

http://139.59.53.236/sugar_version.json

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:06:01 event 2948937 GET 301 bytes 169

ann base label observed

Request event observed

/showLogin.cc

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/showLogin.cc

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:06:01 event 2948935 GET 301 bytes 169

ann base label observed

Request event observed

/showLogin.cc

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/showLogin.cc

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:47 event 2948929 GET 404 bytes 7897

ann base label observed

Request event observed

/solr/

referer

http://139.59.53.236/solr/#/

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/solr/

referer

http://139.59.53.236/solr/#/

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:47 event 2948928 GET 404 bytes 7897

ann base label observed

Request event observed

/solr/

referer

http://139.59.53.236/solr/#/

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/solr/

referer

http://139.59.53.236/solr/#/

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:36 event 2948920 GET http —

ann ua 6 label ua

Request Missing User-Agent header

/static/historypage.js

referer

—

UA

—

Annotation facts

label

ua

rule

ua:missing

conf

60.00

details

Request had no User-Agent value (missing/empty field).

More (full fields + snapshot) expand

url

/static/historypage.js

referer

—

UA

—

summary

Missing User-Agent header

details

Request had no User-Agent value (missing/empty field).

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:36 event 2948918 GET http —

ann ua 6 label ua

Request Missing User-Agent header

/static/historypage.js

referer

—

UA

—

Annotation facts

label

ua

rule

ua:missing

conf

60.00

details

Request had no User-Agent value (missing/empty field).

More (full fields + snapshot) expand

url

/static/historypage.js

referer

—

UA

—

summary

Missing User-Agent header

details

Request had no User-Agent value (missing/empty field).

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:36 event 2948921 GET 404 bytes 184

ann base label observed

Request event observed

/static/historypage.js

referer

http://139.59.53.236/static/historypage.js

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/static/historypage.js

referer

http://139.59.53.236/static/historypage.js

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:36 event 2948920 GET http —

ann base label observed

Request event observed

/static/historypage.js

referer

—

UA

—

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/static/historypage.js

referer

—

UA

—

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:36 event 2948919 GET 404 bytes 184

ann base label observed

Request event observed

/static/historypage.js

referer

http://139.59.53.236/static/historypage.js

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/static/historypage.js

referer

http://139.59.53.236/static/historypage.js

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:36 event 2948918 GET http —

ann base label observed

Request event observed

/static/historypage.js

referer

—

UA

—

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/static/historypage.js

referer

—

UA

—

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:09 event 2948909 GET 404 bytes 7898

ann ref 6 label ref

Request External referer observed on an auth-like endpoint

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

ref

rule

ref:external_referer_to_auth

conf

70.00

details

External origins hitting login/auth endpoints can be a signal of phishing landing pages or malicious redirect chains. This is only emitted for auth-like paths.

More (full fields + snapshot) expand

url

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

External referer observed on an auth-like endpoint

details

External origins hitting login/auth endpoints can be a signal of phishing landing pages or malicious redirect chains. This is only emitted for auth-like paths.

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:09 event 2948908 GET 404 bytes 7898

ann ref 6 label ref

Request External referer observed on an auth-like endpoint

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

ref

rule

ref:external_referer_to_auth

conf

70.00

details

External origins hitting login/auth endpoints can be a signal of phishing landing pages or malicious redirect chains. This is only emitted for auth-like paths.

More (full fields + snapshot) expand

url

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

External referer observed on an auth-like endpoint

details

External origins hitting login/auth endpoints can be a signal of phishing landing pages or malicious redirect chains. This is only emitted for auth-like paths.

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:09 event 2948909 GET 404 bytes 7898

ann base label observed

Request event observed

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:09 event 2948908 GET 404 bytes 7898

ann base label observed

Request event observed

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:09 event 2948909 GET 404 bytes 7898

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:09 event 2948909 GET 404 bytes 7898

ann cred label cred

Request Auth endpoint request observed

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

cred

rule

cred:auth_hit:auth_other

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:09 event 2948908 GET 404 bytes 7898

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:09 event 2948908 GET 404 bytes 7898

ann cred label cred

Request Auth endpoint request observed

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

cred

rule

cred:auth_hit:auth_other

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/api/session/properties

referer

http://139.59.53.236/api/session/properties

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:08 event 2948907 GET 301 bytes 169

ann base label observed

Request event observed

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:08 event 2948906 GET 301 bytes 169

ann base label observed

Request event observed

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

event observed

details

—

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:08 event 2948907 GET 301 bytes 169

ann cred 10 label cred

Request Auth redirect (301) on auth endpoint

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

cred

rule

cred:auth_redirect

conf

72.00

details

Redirect outcomes can participate in 'success-after-fails' patterns during aggregation.

More (full fields + snapshot) expand

url

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

Auth redirect (301) on auth endpoint

details

Redirect outcomes can participate in 'success-after-fails' patterns during aggregation.

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:08 event 2948907 GET 301 bytes 169

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

# 2025-02-25 12:05:08 event 2948907 GET 301 bytes 169

ann cred label cred

Request Auth endpoint request observed

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

Annotation facts

label

cred

rule

cred:auth_hit:auth_other

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/api/session/properties

referer

-

UA

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

45.156.129.0/24

asn

211680 — NSEC - Sistemas Informaticos, S.A.

geo

United States, Illinois, Chicago

org

Inap CHI

Page 1 of 2

← Prev Next →