node

[[TODO: MAP ONE SENTENCE SUMMARY]]

Category: [[TODO: MAP CATEGORY]] Avg 3.6 req/min Seen on 56 systems 480 observed requests 1 exact variants First seen August 6, 2026 Last seen October 17, 2026

[[TODO: MAP INTRODUCTION PARAGRAPH 1]]

[[TODO: MAP INTRODUCTION PARAGRAPH 2]]

What is node?

[[TODO: MAP DEFINITION SUMMARY]]

[[TODO: MAP SHORT REFERENCE SUMMARY]]

Analyst summary: [[TODO: MAP ANALYST REPORT SUMMARY]]
User-agent
node
Observed source IPs
0
Observed requests
480
Source networks
183
Exact variants
1
Latest hit count
538
Latest miss count
31
Latest 404 count
0
Unique paths
22
Related campaigns
[[TODO: MAP RELATED CAMPAIGN COUNT]]

Observed exact user-agent strings

node First seen August 6, 2026 · Last seen October 17, 2026

Behavior profile

[[TODO: MAP BEHAVIOR PROFILE INTRO]]

Category
[[TODO: MAP CATEGORY]]
Average request rate
3.6 requests per minute
HTTP and HTTPS support
[[TODO: MAP HTTP HTTPS SUPPORT]]
HTTP version support
[[TODO: MAP PROTOCOL SUPPORT SUMMARY]]
Redirect behavior
[[TODO: MAP REDIRECT BEHAVIOR]]
Robots.txt behavior
[[TODO: MAP ROBOTS TXT BEHAVIOR]]
Crawl-rate behavior
[[TODO: MAP CRAWL RATE BEHAVIOR]]
JavaScript execution
[[TODO: MAP JAVASCRIPT SUPPORT]]
Form submission activity
[[TODO: MAP FORM SUBMISSION ACTIVITY]]
Malformed URL requests
[[TODO: MAP MALFORMED URL BEHAVIOR]]
HTTP/1.0: [[TODO: MAP HTTP 1.0 SUPPORT]] HTTP/1.1: [[TODO: MAP HTTP 1.1 SUPPORT]] HTTP/2: [[TODO: MAP HTTP 2 SUPPORT]] HTTP/3: [[TODO: MAP HTTP 3 SUPPORT]] [[TODO: MAP HEADER ORDER FINGERPRINTED]]

Source distribution

[[TODO: MAP SOURCE DISTRIBUTION INTRO]]

Top countries

Country Networks Site sightings Share
United States 119 152 66.9%
Unknown 32 32 14.4%
Australia 1 1 3.8%
United Kingdom 5 5 3.8%
Germany 6 8 2.9%
Japan 4 6 1.5%
Netherlands 2 2 1.3%
Egypt 2 3 1.0%
Switzerland 2 4 1.0%
Lithuania 1 1 1.0%

Top ASNs

ASN Organization Networks Share
AS16509 [[TODO: MAP ASN ORGANIZATION]] 32 20.8%
AS14618 [[TODO: MAP ASN ORGANIZATION]] 28 19.2%
AS396982 [[TODO: MAP ASN ORGANIZATION]] 25 9.6%
AS14061 [[TODO: MAP ASN ORGANIZATION]] 13 9.0%
AS134090 [[TODO: MAP ASN ORGANIZATION]] 1 3.8%
AS8075 [[TODO: MAP ASN ORGANIZATION]] 3 2.7%
AS8560 [[TODO: MAP ASN ORGANIZATION]] 3 2.3%
AS8422 [[TODO: MAP ASN ORGANIZATION]] 4 1.7%
AS17506 [[TODO: MAP ASN ORGANIZATION]] 3 1.3%
AS20473 [[TODO: MAP ASN ORGANIZATION]] 4 1.3%

Top datacenters

Provider Type Snapshots Share

Representative source IPs

[[TODO: MAP REPRESENTATIVE IPS INTRO]]

HTTP fingerprint and request characteristics

[[TODO: MAP HTTP FINGERPRINT INTRO]]

Observed header order
[[TODO: MAP HTTP HEADER ORDER SUMMARY]]
Common headers sent
[[TODO: MAP COMMON HEADERS SUMMARY]]
TLS and HTTPS behavior
[[TODO: MAP TLS HTTPS SUMMARY]]
URL normalization behavior
[[TODO: MAP URL NORMALIZATION SUMMARY]]
Malformed request patterns
[[TODO: MAP MALFORMED REQUEST SUMMARY]]
[[TODO: MAP OBSERVED HTTP HEADERS]]

Observed sample requests

[[TODO: MAP SAMPLE REQUESTS INTRO]]

GET
/wp-json/wp/v2/pages?per_page=100&_fields=id%2Clink%2Ctitle%2Ccontent
Status pattern: HTTP 200
Seen 1 times, Last seen October 13, 2026
GET
/wp-json/wp/v2/types
Status pattern: HTTP 200
Seen 1 times, Last seen October 13, 2026
GET
/wp-sitemap.xml
Status pattern: HTTP 200
Seen 1 times, Last seen October 13, 2026
GET
/wp-json/wp/v2/posts?search=job&per_page=100&_fields=id%2Cdate%2Clink%2Ctitle
Status pattern: HTTP 200
Seen 1 times, Last seen October 13, 2026
GET
/wp-json/wp/v2/posts?search=hiring&per_page=100&_fields=id%2Cdate%2Clink%2Ctitle
Status pattern: HTTP 200
Seen 1 times, Last seen October 13, 2026
GET
/wp-json/wp/v2/pages?per_page=100&_fields=id%2Cslug%2Clink%2Ctitle%2Cmodified_gmt
Status pattern: HTTP 200
Seen 1 times, Last seen October 13, 2026
GET
/wp-json/wp/v2/posts?search=employment&per_page=100&_fields=id%2Cdate%2Clink%2Ctitle
Status pattern: HTTP 200
Seen 1 times, Last seen October 13, 2026
GET
/contact/
Status pattern: HTTP 200
Seen 1 times, Last seen October 13, 2026
POST
/wp-json/bitfire/v1/browser-verify?_fn=xhr&_bfa=d19ba7f6aba1208590607fcb.au2ui_w0wk7e.1791828000&per=0&_bfg=%5B%5D
Status pattern: HTTP 200
Seen 1 times, Last seen October 13, 2026
POST
/wp-json/bitfire/v1/browser-verify?_fn=xhr&_bfa=b9c02a526977f30de6ff24e4.ja2oezrthhe1.1791871200&per=0&_bfg=%5B%5D
Status pattern: HTTP 200
Seen 1 times, Last seen October 13, 2026
GET
/sitemap_index.xml
Status pattern: HTTP 200
Seen 4 times, Last seen September 25, 2026
GET
/robots.txt
Status pattern: HTTP 200
Seen 2 times, Last seen September 25, 2026

Related campaigns and associations

[[TODO: MAP RELATED CAMPAIGNS INTRO]]

[[TODO: MAP RELATED CAMPAIGN NAME]]

[[TODO: MAP RELATED CAMPAIGN SUMMARY]]
Related IPs: [[TODO: MAP RELATED CAMPAIGN IP COUNT]], Systems seen: [[TODO: MAP RELATED CAMPAIGN SYSTEMS SEEN]]
Confidence: [[TODO: MAP RELATED CAMPAIGN CONFIDENCE]]

Detailed analyst report

[[TODO: MAP ANALYST REPORT PARAGRAPH 1]]

[[TODO: MAP ANALYST REPORT PARAGRAPH 2]]

[[TODO: MAP ANALYST REPORT PARAGRAPH 3]]

Frequently asked questions about node

What is node?

[[TODO: MAP FAQ WHAT IS ANSWER]]

Is node considered malicious?

[[TODO: MAP FAQ MALICIOUS ANSWER]]

Does node respect robots.txt and crawl-rate controls?

[[TODO: MAP FAQ ROBOTS ANSWER]]

What infrastructure is commonly associated with node?

[[TODO: MAP FAQ INFRASTRUCTURE ANSWER]]