Report categories

Every report carries one or more of these. Use the code in the API, separated by commas: categories=ssh,brute-force. Older scripts can still send the numeric ID (22,18); numbers 1 to 23 match what most existing tools already use.

Web

Code	Name	Use it for	ID
web-spam	Web Spam	Comment, forum or referrer spam aimed at websites.	10
blog-spam	Blog Spam	Spam posted into blog comment forms.	12
sql-injection	SQL Injection	Trying to inject SQL through forms, query strings or headers.	16
bad-bot	Bad Web Bot	Scrapers and crawlers that ignore robots.txt, fake their user agent or hammer a site.	19
web-app-attack	Web App Attack	Probing or exploiting web applications: WordPress, Drupal, phpMyAdmin, shop software, plugins.	21
xss	Cross-Site Scripting	Injecting script into pages through parameters, forms or headers.	26
path-traversal	Path Traversal / LFI	Requests for ../../etc/passwd, .env, .git and other files outside the web root.	27
rce	Remote Code Execution	Exploit attempts that try to run commands on the server (Log4Shell, command injection, deserialisation).	28
api-abuse	API Abuse	Hammering, scraping or fuzzing an API beyond fair use.	34

Authentication

Code	Name	Use it for	ID
ftp-brute-force	FTP Brute-Force	Guessing passwords against FTP or FTPS servers.	5
brute-force	Brute-Force	Password guessing against logins: SSH, RDP, FTP, SMTP, web forms and so on.	18
ssh	SSH	Abuse of the SSH service. Use together with Brute-Force or Hacking.	22
rdp	RDP Abuse	Login attempts or exploits against Remote Desktop.	24
credential-stuffing	Credential Stuffing	Logging in with username and password pairs leaked from other sites.	29
telnet	Telnet Abuse	Login attempts against Telnet, usually from IoT botnets.	40

Network

Code	Name	Use it for	ID
ddos	DDoS Attack	Taking part in a distributed denial-of-service attack, usually as part of a botnet.	4
ping-of-death	Ping of Death	Malformed or oversized packets sent to crash a host.	6
port-scan	Port Scan	Scanning for open ports and listening services.	14
hacking	Hacking	General intrusion attempts that do not fit a more specific category.	15
iot	IoT Targeted	Attacks aimed at routers, cameras and other connected devices. Mention the device in the comment.	23
vuln-scan	Vulnerability Scan	Automated scanning for known CVEs and misconfigurations.	30
database-attack	Database Attack	Attacks on exposed MySQL, PostgreSQL, Redis, MongoDB, Elasticsearch and similar.	36
http-flood	HTTP Flood	Layer 7 flood: large numbers of HTTP requests meant to exhaust a site.	37

Email & messaging

Code	Name	Use it for	ID
phishing	Phishing	Hosting phishing pages or sending phishing email.	7
email-spam	Email Spam	Unsolicited bulk email or mail carrying malicious attachments.	11
spoofing	Spoofing	Forging the sender of an email or the source of traffic.	17
mail-server-attack	Mail Server Attack	Password guessing or relay attempts against SMTP, IMAP or POP3.	25

Fraud

Code	Name	Use it for	ID
fraud-orders	Fraud Orders	Placing fraudulent orders in a shop or booking system.	3
voip-fraud	VoIP Fraud	SIP scanning, toll fraud and unauthorised calls through a phone system.	8
card-testing	Card Testing	Checking stolen payment cards with small transactions.	35
sms-pumping	SMS / OTP Pumping	Triggering SMS or one-time-password messages to rack up telecom charges.	38
fake-accounts	Fake Accounts	Mass sign-ups, fake reviews or account farming.	39

Infrastructure

Code	Name	Use it for	ID
dns-compromise	DNS Compromise	Altering DNS records so that traffic is sent somewhere it should not go.	1
dns-poisoning	DNS Poisoning	Falsifying a resolver's cache (cache poisoning).	2
open-proxy	Open Proxy	Open proxy or open relay. For Tor exit nodes use Tor Exit Node.	9
vpn	VPN IP	The address belongs to a VPN service. Use together with another category.	13
exploited-host	Exploited Host	The machine looks compromised and is being used to attack others. Use with another category.	20
malware-hosting	Malware Distribution	Serving malware, droppers or malicious payloads.	31
c2	Command & Control	Botnet or malware command-and-control server.	32
cryptojacking	Cryptojacking	Dropping or controlling unauthorised cryptocurrency miners.	33
tor-exit	Tor Exit Node	Abuse arriving through a Tor exit relay. The operator is usually not the attacker; use together with what was done.	41

Combining categories

A few categories describe where something happened rather than what. SSH, VPN IP, IoT Targeted and Exploited Host make most sense next to another one. Some combinations that come up all the time:

Password guessing on sshd: ssh,brute-force (SSH, Brute-Force)
WordPress login flood: web-app-attack,brute-force (Web App Attack, Brute-Force)
/.env and /.git/config probes: path-traversal,vuln-scan (Path Traversal, Vulnerability Scan)
Log4Shell or command injection in a header: rce,web-app-attack (Remote Code Execution, Web App Attack)
SMTP AUTH guessing on Postfix: mail-server-attack,brute-force (Mail Server Attack, Brute-Force)
Mirai-style telnet logins: telnet,iot,brute-force (Telnet, IoT Targeted, Brute-Force)

Missing something? Tell us. We add categories, we never renumber them.