Last 24 hours · Apr 11, 2026 00:00 – Apr 12, 2026 00:00 UTC
Generated: 2026-04-12 00:00:32 UTC
Radial Sonar
Network Activity by Protocol & Risk
Normal 59Internal 14Suspect 0Alert 4Threshold (65%)
Center = benign · outer ring = high-risk. Spokes are protocols sorted by frequency. Hover any point for detail.
IP Reputation
Destination IPs with elevated AbuseIPDB reputation scores. Higher scores indicate greater risk.
IP Reputation
8 rows
| Destination IP | Country | Organization | Risk Score | Flows | Internal Clients | Total MB |
|---|---|---|---|---|---|---|
| 198.51.100.200 | RU | Bulletproof Hosting Ltd | 98 | 4,284 | 12 | 847.3 |
| 203.0.113.88 | CN | Shady VPS Provider | 94 | 2,847 | 8 | 423.1 |
| 198.51.100.55 | IR | Unknown ISP | 87 | 1,284 | 4 | 284.7 |
| 203.0.113.142 | KP | State Telecom | 82 | 847 | 2 | 142.3 |
| 198.51.100.77 | RU | DDoS-Guard | 76 | 642 | 6 | 98.4 |
| 203.0.113.201 | BR | Compromised Network | 68 | 384 | 3 | 64.2 |
| 198.51.100.33 | UA | Suspicious Hosting | 54 | 247 | 2 | 42.8 |
| 203.0.113.19 | VN | Cloud Provider | 42 | 184 | 1 | 28.4 |
Beaconing Candidates
Connections with highly regular intervals (low coefficient of variation), a common indicator of C2 communication.
Beaconing Candidates
5 rows
| Source IP | Destination IP | Port | Connections | Avg Interval (s) | Stddev (s) | CoV |
|---|---|---|---|---|---|---|
| 10.1.8.50 | 198.51.100.47 | 443 | 1,440 | 60.2 | 1.8 | 0.030 |
| 10.169.112.51 | 203.0.113.88 | 8443 | 720 | 120.1 | 4.2 | 0.035 |
| 10.1.8.13 | 198.51.100.12 | 443 | 480 | 180.3 | 8.7 | 0.048 |
| 10.6.19.21 | 203.0.113.201 | 80 | 288 | 300.0 | 12.4 | 0.041 |
| 172.16.4.10 | 198.51.100.99 | 443 | 96 | 900.5 | 42.1 | 0.047 |
Large Outbound Transfers
Flows exceeding 100 MB outbound that may indicate data exfiltration.
Large Outbound Transfers
5 rows
| Source IP | Destination IP | Port | Country | Organization | Protocol | Sent MB | Duration (s) |
|---|---|---|---|---|---|---|---|
| 10.1.8.50 | 198.51.100.47 | 443 | US | Unknown VPS | tls | 2,847.3 | 3,600 |
| 10.169.112.51 | 91.189.88.142 | 443 | GB | Canonical | tls | 1,284.7 | 7,200 |
| 10.1.8.13 | 52.96.166.130 | 443 | US | Amazon AWS | tls | 847.2 | 1,800 |
| 10.6.19.21 | 104.18.32.68 | 443 | US | Cloudflare | tls | 534.8 | 2,400 |
| 10.1.12.100 | 185.199.108.4 | 443 | NL | GitHub | tls | 384.1 | 900 |
DGA Candidates
DGA Candidates
3 rows
| Source IP | Total Queries | NXDOMAIN | NXDOMAIN % |
|---|---|---|---|
| 10.1.8.50 | 4,284 | 2,847 | 66.5 |
| 10.169.112.51 | 2,847 | 1,284 | 45.1 |
| 10.6.19.21 | 1,847 | 623 | 33.7 |
DNS Tunneling Candidates
DNS Tunneling Candidates
5 rows
| Source IP | Domain | Length | Queries |
|---|---|---|---|
| 10.1.8.50 | aGVsbG8gd29ybGQ.data.c2-exfil-tunnel.suspicious-domain.net | 72 | 847 |
| 10.1.8.50 | dGhpcyBpcyBhIHRlc3Q.beacon.c2-exfil-tunnel.suspicious-domain.net | 78 | 623 |
| 10.169.112.51 | _ldap._tcp.dc1.ad.corp.contoso.com._msdcs.corp.contoso.com | 68 | 284 |
| 10.1.8.13 | adrev-ingress.ad-rev-dev-production-us-east1.gke-svc.example.com | 74 | 142 |
| 10.6.19.21 | pplx-browser-binaries.a0adf9b772aecba4.r2.cloudflarestorage.com | 70 | 98 |
Port Scanning Activity
Hosts probing more than 20 unique ports on a single destination.
Port Scanning Activity
3 rows
| Source IP | Destination IP | Ports Scanned | Flows | First Seen | Last Seen |
|---|---|---|---|---|---|
| 198.51.100.88 | 10.1.8.0/24 | 1,284 | 2,847 | 2026-04-11T06:00:32 | 2026-04-11T22:00:32 |
| 203.0.113.142 | 10.169.112.0/24 | 847 | 1,623 | 2026-04-11T12:00:32 | 2026-04-11T20:00:32 |
| 198.51.100.201 | 172.16.4.0/24 | 423 | 847 | 2026-04-11T16:00:32 | 2026-04-11T18:00:32 |
Suspicious User Agents
HTTP requests using tool-based or known-malicious user agent strings.
Suspicious User Agents
5 rows
| Source IP | User Agent | Requests | Unique Hosts |
|---|---|---|---|
| 10.1.8.50 | python-requests/2.31.0 | 4,284 | 142 |
| 10.169.112.51 | curl/8.4.0 | 1,847 | 84 |
| 10.6.19.21 | Go-http-client/1.1 | 847 | 42 |
| 10.1.8.13 | Wget/1.21 | 384 | 28 |
| 172.16.4.10 | Mozilla/4.0 (compatible; MSIE 6.0) | 142 | 12 |