Threat Categories

The threat feeds classify each IP address into one or multiple threat categories based on behavior observed across Threat Protection’s global sensor network and attack data, providing security teams with clear context to assess and respond effectively.

Tag	Definition
PORT_SCANNING	The source IP attempted to scan or probe a port on one of our sensors (e.g., banner grabbing).
CREDENTIAL_STUFFING	The source IP attempted to input credentials on one of our sensors. For example, a sensor with FTP running on port 22 is reached by a malicious actor and a dictionary attack is used.
SPAM	The source IP sent spam email to one of our sensor's SMTP servers.
WEB_ATTACK	The source IP attempted a Layer 7 attack, such as SQL injection (SQLi), remote code execution (RCE), cross-site scripting (XSS), or path traversal.
MALWARE	The source IP attempted to upload a malicious payload to one of our sensors.
AMPLIFICATION	The source IP is not necessarily the threat actor, but rather the reflector in an amplification attack (e.g., DNS amplification) used to forward heavy traffic to a victim.
ANONYMOUS_PROXY	The source IP obfuscates the true origin of the traffic and acts as a proxy or intermediary, such as a VPN server or Tor exit node.
NTP_REFLECTION	The source IP is an NTP server being exploited by an attacker who sent UDP packets with a spoofed source IP address targeting our honeypot.
NETWORK_DDOS	The source IP has been observed to participate in a Distributed-Denial-of-Service (DDoS) attack.
APPLICATION_DDOS	The source IP attempted to exploit vulnerabilities or exhaust system resources on a sensor (e.g., slowloris attacks, HTTP flooding, or sending oversized payloads).