IP Address Overview

Automated client behavior bot Traffic patterns strongly suggest automation rather than a human-operated browser. 421939 hits 210969.50 pts

Severity	Hits	Labels	Weighted	Top labels
10	421939	1	210969.50	{'count': 421939, 'label': 'bot'}

Scan velocity scan_velocity High request rate and broad endpoint coverage suggest scanning or automated enumeration. 46657 hits 56584.80 pts

Severity	Hits	Labels	Weighted	Top labels
10	29437	1	52986.60	{'count': 29437, 'label': 'scan_velocity'}
12	642	1	1386.72	{'count': 642, 'label': 'scan_velocity'}
14	440	1	1108.80	{'count': 440, 'label': 'scan_velocity'}
18	88	1	285.12	{'count': 88, 'label': 'scan_velocity'}
16	89	1	256.32	{'count': 89, 'label': 'scan_velocity'}
24	45	1	194.40	{'count': 45, 'label': 'scan_velocity'}
20	41	1	147.60	{'count': 41, 'label': 'scan_velocity'}
22	33	1	130.68	{'count': 33, 'label': 'scan_velocity'}
26	9	1	42.12	{'count': 9, 'label': 'scan_velocity'}
28	6	1	30.24	{'count': 6, 'label': 'scan_velocity'}
30	3	1	16.20	{'count': 3, 'label': 'scan_velocity'}
0	15824	1	0.00	{'count': 15824, 'label': 'scan_velocity'}

Credential brute forcing cred Repeated authentication attempts consistent with password guessing or credential stuffing. 9042 hits 29828.70 pts

Severity	Hits	Labels	Weighted	Top labels
10	3017	1	16593.50	{'count': 3017, 'label': 'cred'}
8	3008	1	13235.20	{'count': 3008, 'label': 'cred'}
0	3017	1	0.00	{'count': 3017, 'label': 'cred'}

Referrer abuse ref Referrer patterns look manipulated, irrelevant, or inconsistent with normal navigation. 3017 hits 543.24 pts

Severity	Hits	Labels	Weighted	Top labels
6	3015	1	542.70	{'count': 3015, 'label': 'ref'}
9	2	1	0.54	{'count': 2, 'label': 'ref'}

Command injection attempts cmdi Request content resembles attempts to execute OS commands via an application. 18 hits 436.90 pts

Severity	Hits	Labels	Weighted	Top labels
28	9	1	214.20	{'count': 9, 'label': 'cmdi'}
30	8	1	204.00	{'count': 8, 'label': 'cmdi'}
22	1	1	18.70	{'count': 1, 'label': 'cmdi'}

Sensitive file probing sfp Requests target commonly sensitive files, configs, backups, or administrative resources. 47 hits 378.40 pts

Severity	Hits	Labels	Weighted	Top labels
40	30	1	264.00	{'count': 30, 'label': 'sensitive_file'}
36	8	1	63.36	{'count': 8, 'label': 'sensitive_file'}
22	3	1	14.52	{'count': 3, 'label': 'sensitive_file'}
24	2	1	10.56	{'count': 2, 'label': 'sensitive_file'}
44	1	1	9.68	{'count': 1, 'label': 'sensitive_file'}
42	1	1	9.24	{'count': 1, 'label': 'sensitive_file'}
16	2	1	7.04	{'count': 2, 'label': 'sensitive_file'}

Path traversal attempts trav Request paths/parameters resemble attempts to access files outside intended directories. 5 hits 44.20 pts

Severity	Hits	Labels	Weighted	Top labels
34	5	1	44.20	{'count': 5, 'label': 'trav'}

Firewall probing fwprobe Traffic behavior suggests probing of access controls and protected surfaces. 3 hits 39.60 pts

Severity	Hits	Labels	Weighted	Top labels
30	2	1	27.00	{'count': 2, 'label': 'fwprobe'}
28	1	1	12.60	{'count': 1, 'label': 'fwprobe'}

Header injection attempts hdrinj Input patterns suggest attempts to manipulate headers or downstream header parsing. 1 hits 19.20 pts

Severity	Hits	Labels	Weighted	Top labels
24	1	1	19.20	{'count': 1, 'label': 'hdrinj'}

Protocol anomaly proto Request structure or protocol-level signals deviate from typical browser HTTP traffic. 2 hits 3.84 pts

Severity	Hits	Labels	Weighted	Top labels
24	2	1	3.84	{'count': 2, 'label': 'proto'}