The risk score for this supernet indicates elevated risk at the aggregated network level. Higher scores reflect stronger signals identified across related subnets.
The supernet (103.196.0.0/16) exhibits coordinated behavior with multiple IPs accessing the same site using similar user agents, indicating potential automated scraping or bot activity. The presence of honeypot hits and low interaction suggests stealthy operations, while the lack of legitimate DNS resolution raises concerns about the legitimacy of the traffic.
The following signals are generated automatically and do not override the overall risk score shown above.