Subnet Overview

Command injection attempts cmdi Request content resembles attempts to execute OS commands via an application. 55 hits 1278.40 pts

Severity	Hits	Labels	Weighted	Top labels
30	21	1	535.50	{'count': 21, 'label': 'cmdi'}
28	21	1	499.80	{'count': 21, 'label': 'cmdi'}
22	13	1	243.10	{'count': 13, 'label': 'cmdi'}

Sensitive file probing sfp Requests target commonly sensitive files, configs, backups, or administrative resources. 24 hits 192.72 pts

Severity	Hits	Labels	Weighted	Top labels
36	21	1	166.32	{'count': 21, 'label': 'sensitive_file'}
40	3	1	26.40	{'count': 3, 'label': 'sensitive_file'}

User-Agent anomaly ua User-Agent signals look missing, inconsistent, or indicative of non-browser tooling. 368 hits 59.80 pts

Severity	Hits	Labels	Weighted	Top labels
8	327	1	52.32	{'count': 327, 'label': 'ua'}
10	32	1	6.40	{'count': 32, 'label': 'ua'}
6	9	1	1.08	{'count': 9, 'label': 'ua'}

HTTP method anomaly method Unusual or unexpected HTTP methods observed for the target endpoints. 118 hits 56.64 pts

Severity	Hits	Labels	Weighted	Top labels
8	118	1	56.64	{'count': 118, 'label': 'method'}

Credential brute forcing cred Repeated authentication attempts consistent with password guessing or credential stuffing. 9 hits 33.00 pts

Severity	Hits	Labels	Weighted	Top labels
10	6	1	33.00	{'count': 6, 'label': 'cred'}
0	3	1	0.00	{'count': 3, 'label': 'cred'}

Protocol anomaly proto Request structure or protocol-level signals deviate from typical browser HTTP traffic. 3 hits 2.88 pts

Severity	Hits	Labels	Weighted	Top labels
12	3	1	2.88	{'count': 3, 'label': 'proto'}

Automated client behavior bot Traffic patterns strongly suggest automation rather than a human-operated browser. 5 hits 2.00 pts

Severity	Hits	Labels	Weighted	Top labels
8	5	1	2.00	{'count': 5, 'label': 'bot'}