Subnet Overview

Sensitive file probing sfp Requests target commonly sensitive files, configs, backups, or administrative resources. 1398 hits 11081.84 pts

Severity	Hits	Labels	Weighted	Top labels
40	907	1	7981.60	{'count': 907, 'label': 'sensitive_file'}
34	232	1	1735.36	{'count': 232, 'label': 'sensitive_file'}
16	160	1	563.20	{'count': 160, 'label': 'sensitive_file'}
44	55	1	532.40	{'count': 55, 'label': 'sensitive_file'}
30	28	1	184.80	{'count': 28, 'label': 'sensitive_file'}
24	16	1	84.48	{'count': 16, 'label': 'sensitive_file'}

Path traversal attempts trav Request paths/parameters resemble attempts to access files outside intended directories. 612 hits 4451.20 pts

Severity	Hits	Labels	Weighted	Top labels
26	284	1	1919.84	{'count': 284, 'label': 'trav'}
28	236	1	1718.08	{'count': 236, 'label': 'trav'}
34	92	1	813.28	{'count': 92, 'label': 'trav'}

User-Agent anomaly ua User-Agent signals look missing, inconsistent, or indicative of non-browser tooling. 8598 hits 1453.64 pts

Severity	Hits	Labels	Weighted	Top labels
8	7903	1	1264.48	{'count': 7903, 'label': 'ua'}
14	644	1	180.32	{'count': 644, 'label': 'ua'}
10	34	1	6.80	{'count': 34, 'label': 'ua'}
6	17	1	2.04	{'count': 17, 'label': 'ua'}

Scan velocity scan_velocity High request rate and broad endpoint coverage suggest scanning or automated enumeration. 523 hits 1266.48 pts

Severity	Hits	Labels	Weighted	Top labels
10	108	1	194.40	{'count': 108, 'label': 'scan_velocity'}
30	36	1	194.40	{'count': 36, 'label': 'scan_velocity'}
32	28	1	161.28	{'count': 28, 'label': 'scan_velocity'}
24	37	1	159.84	{'count': 37, 'label': 'scan_velocity'}
26	28	1	131.04	{'count': 28, 'label': 'scan_velocity'}
28	24	1	120.96	{'count': 24, 'label': 'scan_velocity'}
22	20	1	79.20	{'count': 20, 'label': 'scan_velocity'}
16	20	1	57.60	{'count': 20, 'label': 'scan_velocity'}
12	24	1	51.84	{'count': 24, 'label': 'scan_velocity'}
14	20	1	50.40	{'count': 20, 'label': 'scan_velocity'}
34	4	1	24.48	{'count': 4, 'label': 'scan_velocity'}
20	6	1	21.60	{'count': 6, 'label': 'scan_velocity'}
18	6	1	19.44	{'count': 6, 'label': 'scan_velocity'}
0	162	1	0.00	{'count': 162, 'label': 'scan_velocity'}

HTTP method anomaly method Unusual or unexpected HTTP methods observed for the target endpoints. 289 hits 113.88 pts

Severity	Hits	Labels	Weighted	Top labels
6	212	1	76.32	{'count': 212, 'label': 'method'}
8	72	1	34.56	{'count': 72, 'label': 'method'}
10	5	1	3.00	{'count': 5, 'label': 'method'}

Protocol anomaly proto Request structure or protocol-level signals deviate from typical browser HTTP traffic. 24 hits 21.28 pts

Severity	Hits	Labels	Weighted	Top labels
11	22	1	19.36	{'count': 22, 'label': 'proto'}
12	2	1	1.92	{'count': 2, 'label': 'proto'}

Credential brute forcing cred Repeated authentication attempts consistent with password guessing or credential stuffing. 4 hits 17.60 pts

Severity	Hits	Labels	Weighted	Top labels
10	2	1	11.00	{'count': 2, 'label': 'cred'}
12	1	1	6.60	{'count': 1, 'label': 'cred'}
0	1	1	0.00	{'count': 1, 'label': 'cred'}

Firewall probing fwprobe Traffic behavior suggests probing of access controls and protected surfaces. 1 hits 13.50 pts

Severity	Hits	Labels	Weighted	Top labels
30	1	1	13.50	{'count': 1, 'label': 'fwprobe'}

Automated client behavior bot Traffic patterns strongly suggest automation rather than a human-operated browser. 1 hits 0.50 pts

Severity	Hits	Labels	Weighted	Top labels
10	1	1	0.50	{'count': 1, 'label': 'bot'}