Subnet Overview

Sensitive file probing sfp Requests target commonly sensitive files, configs, backups, or administrative resources. 32 hits 223.08 pts

Severity	Hits	Labels	Weighted	Top labels
40	8	1	70.40	{'count': 8, 'label': 'sensitive_file'}
24	13	1	68.64	{'count': 13, 'label': 'sensitive_file'}
34	7	1	52.36	{'count': 7, 'label': 'sensitive_file'}
36	4	1	31.68	{'count': 4, 'label': 'sensitive_file'}

Path traversal attempts trav Request paths/parameters resemble attempts to access files outside intended directories. 20 hits 145.08 pts

Severity	Hits	Labels	Weighted	Top labels
28	7	1	50.96	{'count': 7, 'label': 'trav'}
26	7	1	47.32	{'count': 7, 'label': 'trav'}
30	6	1	46.80	{'count': 6, 'label': 'trav'}

Credential brute forcing cred Repeated authentication attempts consistent with password guessing or credential stuffing. 32 hits 132.00 pts

Severity	Hits	Labels	Weighted	Top labels
10	12	1	66.00	{'count': 12, 'label': 'cred'}
12	10	1	66.00	{'count': 10, 'label': 'cred'}
0	10	1	0.00	{'count': 10, 'label': 'cred'}

User-Agent anomaly ua User-Agent signals look missing, inconsistent, or indicative of non-browser tooling. 62 hits 10.08 pts

Severity	Hits	Labels	Weighted	Top labels
8	58	1	9.28	{'count': 58, 'label': 'ua'}
10	4	1	0.80	{'count': 4, 'label': 'ua'}

HTTP method anomaly method Unusual or unexpected HTTP methods observed for the target endpoints. 16 hits 7.68 pts

Severity	Hits	Labels	Weighted	Top labels
8	16	1	7.68	{'count': 16, 'label': 'method'}

Protocol anomaly proto Request structure or protocol-level signals deviate from typical browser HTTP traffic. 2 hits 1.92 pts

Severity	Hits	Labels	Weighted	Top labels
12	2	1	1.92	{'count': 2, 'label': 'proto'}

Automated client behavior bot Traffic patterns strongly suggest automation rather than a human-operated browser. 1 hits 0.50 pts

Severity	Hits	Labels	Weighted	Top labels
10	1	1	0.50	{'count': 1, 'label': 'bot'}