IP Address Overview

Automated client behavior bot Traffic patterns strongly suggest automation rather than a human-operated browser. 416565 hits 208282.50 pts

Severity	Hits	Labels	Weighted	Top labels
10	416565	1	208282.50	{'count': 416565, 'label': 'bot'}

Scan velocity scan_velocity High request rate and broad endpoint coverage suggest scanning or automated enumeration. 45763 hits 55505.16 pts

Severity	Hits	Labels	Weighted	Top labels
10	28730	1	51714.00	{'count': 28730, 'label': 'scan_velocity'}
12	659	1	1423.44	{'count': 659, 'label': 'scan_velocity'}
14	375	1	945.00	{'count': 375, 'label': 'scan_velocity'}
18	157	1	508.68	{'count': 157, 'label': 'scan_velocity'}
20	86	1	309.60	{'count': 86, 'label': 'scan_velocity'}
16	96	1	276.48	{'count': 96, 'label': 'scan_velocity'}
22	64	1	253.44	{'count': 64, 'label': 'scan_velocity'}
24	14	1	60.48	{'count': 14, 'label': 'scan_velocity'}
26	3	1	14.04	{'count': 3, 'label': 'scan_velocity'}
0	15579	1	0.00	{'count': 15579, 'label': 'scan_velocity'}

Credential brute forcing cred Repeated authentication attempts consistent with password guessing or credential stuffing. 8246 hits 27200.80 pts

Severity	Hits	Labels	Weighted	Top labels
10	2752	1	15136.00	{'count': 2752, 'label': 'cred'}
8	2742	1	12064.80	{'count': 2742, 'label': 'cred'}
0	2752	1	0.00	{'count': 2752, 'label': 'cred'}

Sensitive file probing sfp Requests target commonly sensitive files, configs, backups, or administrative resources. 89 hits 729.52 pts

Severity	Hits	Labels	Weighted	Top labels
40	69	1	607.20	{'count': 69, 'label': 'sensitive_file'}
36	10	1	79.20	{'count': 10, 'label': 'sensitive_file'}
16	5	1	17.60	{'count': 5, 'label': 'sensitive_file'}
24	3	1	15.84	{'count': 3, 'label': 'sensitive_file'}
22	2	1	9.68	{'count': 2, 'label': 'sensitive_file'}

Referrer abuse ref Referrer patterns look manipulated, irrelevant, or inconsistent with normal navigation. 2752 hits 495.54 pts

Severity	Hits	Labels	Weighted	Top labels
6	2750	1	495.00	{'count': 2750, 'label': 'ref'}
9	2	1	0.54	{'count': 2, 'label': 'ref'}

Command injection attempts cmdi Request content resembles attempts to execute OS commands via an application. 18 hits 436.90 pts

Severity	Hits	Labels	Weighted	Top labels
28	9	1	214.20	{'count': 9, 'label': 'cmdi'}
30	8	1	204.00	{'count': 8, 'label': 'cmdi'}
22	1	1	18.70	{'count': 1, 'label': 'cmdi'}

Path traversal attempts trav Request paths/parameters resemble attempts to access files outside intended directories. 6 hits 53.04 pts

Severity	Hits	Labels	Weighted	Top labels
34	6	1	53.04	{'count': 6, 'label': 'trav'}

Firewall probing fwprobe Traffic behavior suggests probing of access controls and protected surfaces. 2 hits 26.10 pts

Severity	Hits	Labels	Weighted	Top labels
30	1	1	13.50	{'count': 1, 'label': 'fwprobe'}
28	1	1	12.60	{'count': 1, 'label': 'fwprobe'}

Header injection attempts hdrinj Input patterns suggest attempts to manipulate headers or downstream header parsing. 1 hits 19.20 pts

Severity	Hits	Labels	Weighted	Top labels
24	1	1	19.20	{'count': 1, 'label': 'hdrinj'}

Protocol anomaly proto Request structure or protocol-level signals deviate from typical browser HTTP traffic. 2 hits 3.84 pts

Severity	Hits	Labels	Weighted	Top labels
24	2	1	3.84	{'count': 2, 'label': 'proto'}