{"ip":"176.65.134.121","total_events":195,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"network services","why":["195 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 7,488 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"7,488 bytes sent","bytes_sent":7488,"session_seconds":2,"persistent":false}},"first_seen":"2026-09-20T03:28:02","last_seen":"2026-09-28T01:53:54","events_24h":0,"events_7d":123,"geo":{"country_code":"DE","country_name":"Germany","region":"","city":"","lat":51.2993,"lon":9.491,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":"176.65.134.121.ptr.pfcloud.network","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":125},{"port":37215,"proto":"tcp","label":"","count":64},{"port":80,"proto":"tcp","label":"HTTP","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b10lun000_00000000_334359b9"]},"fingerprint_peers":{"b10lun000_00000000_334359b9":2218},"akin_families":{"b10lun000_00000000_334359b9":{"head":"b10lun000_00000000_334359b9","shapes":2,"ips":2218}},"user_agents":[],"timeline":[{"date":"2026-09-20","count":16},{"date":"2026-09-22","count":9},{"date":"2026-09-23","count":53},{"date":"2026-09-24","count":32},{"date":"2026-09-25","count":40},{"date":"2026-09-26","count":24},{"date":"2026-09-27","count":19},{"date":"2026-09-28","count":2}],"recent_events":[{"timestamp":"2026-09-28T01:53:54","port":37215,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nMAN: \"ssdp:discover\"\r\nMX: 2\r\nST: upnp:rootdevice\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20320d0a53543a2075706e703a726f6f746465766963650d0a0d0a","method":"","user_agent":"","ja3":"","session":"becc28ed-22d2-410e-988a-f578e6880783","seq":1,"duration_ms":100,"bytes_in":101,"bytes_out":14,"enriched":{"digest":"523b530e827a3937","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","MAN: \"ssdp:discover\"","MX: 2","ST: upnp:rootdevice"],"iocs":{"ips":["239.255.255.250"]}}},{"timestamp":"2026-09-28T00:45:35","port":37215,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nMAN: \"ssdp:discover\"\r\nMX: 2\r\nST: upnp:rootdevice\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20320d0a53543a2075706e703a726f6f746465766963650d0a0d0a","method":"","user_agent":"","ja3":"","session":"1de85a68-d928-4e6d-b7e2-17f2cc251a9e","seq":1,"duration_ms":100,"bytes_in":101,"bytes_out":14,"enriched":{"digest":"523b530e827a3937","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","MAN: \"ssdp:discover\"","MX: 2","ST: upnp:rootdevice"],"iocs":{"ips":["239.255.255.250"]}}},{"timestamp":"2026-09-27T23:37:23","port":37215,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nMAN: \"ssdp:discover\"\r\nMX: 2\r\nST: upnp:rootdevice\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20320d0a53543a2075706e703a726f6f746465766963650d0a0d0a","method":"","user_agent":"","ja3":"","session":"5a9054d6-8c6a-4259-9708-2240ceae557e","seq":1,"duration_ms":100,"bytes_in":101,"bytes_out":14,"enriched":{"digest":"523b530e827a3937","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","MAN: \"ssdp:discover\"","MX: 2","ST: upnp:rootdevice"],"iocs":{"ips":["239.255.255.250"]}}},{"timestamp":"2026-09-27T23:21:23","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"48454144202f20485454502f312e300d0a0d0a","method":"HEAD","user_agent":"","ja3":"","session":"96dca059-2777-4da8-a550-68f747d61c2e","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":79},{"timestamp":"2026-09-27T22:29:13","port":37215,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nMAN: \"ssdp:discover\"\r\nMX: 2\r\nST: upnp:rootdevice\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20320d0a53543a2075706e703a726f6f746465766963650d0a0d0a","method":"","user_agent":"","ja3":"","session":"e84d238d-c008-4ae5-8a9f-ddb2d2ef8193","seq":1,"duration_ms":100,"bytes_in":101,"bytes_out":14,"enriched":{"digest":"523b530e827a3937","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","MAN: \"ssdp:discover\"","MX: 2","ST: upnp:rootdevice"],"iocs":{"ips":["239.255.255.250"]}}},{"timestamp":"2026-09-27T21:22:10","port":37215,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nMAN: \"ssdp:discover\"\r\nMX: 2\r\nST: upnp:rootdevice\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20320d0a53543a2075706e703a726f6f746465766963650d0a0d0a","method":"","user_agent":"","ja3":"","session":"dccf689e-c7f7-48b6-b5cf-3cf0b5a3f1af","seq":1,"duration_ms":100,"bytes_in":101,"bytes_out":14,"enriched":{"digest":"523b530e827a3937","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","MAN: \"ssdp:discover\"","MX: 2","ST: upnp:rootdevice"],"iocs":{"ips":["239.255.255.250"]}}},{"timestamp":"2026-09-27T20:14:06","port":37215,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nMAN: \"ssdp:discover\"\r\nMX: 2\r\nST: upnp:rootdevice\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20320d0a53543a2075706e703a726f6f746465766963650d0a0d0a","method":"","user_agent":"","ja3":"","session":"f64c4bac-c552-4152-acd9-4598b76e1e9a","seq":1,"duration_ms":100,"bytes_in":101,"bytes_out":14,"enriched":{"digest":"523b530e827a3937","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","MAN: \"ssdp:discover\"","MX: 2","ST: upnp:rootdevice"],"iocs":{"ips":["239.255.255.250"]}}},{"timestamp":"2026-09-27T19:06:28","port":37215,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nMAN: \"ssdp:discover\"\r\nMX: 2\r\nST: upnp:rootdevice\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20320d0a53543a2075706e703a726f6f746465766963650d0a0d0a","method":"","user_agent":"","ja3":"","session":"34d35ff3-d745-4327-812d-19687bd6ed2b","seq":1,"duration_ms":100,"bytes_in":101,"bytes_out":14,"enriched":{"digest":"523b530e827a3937","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","MAN: \"ssdp:discover\"","MX: 2","ST: upnp:rootdevice"],"iocs":{"ips":["239.255.255.250"]}}},{"timestamp":"2026-09-27T17:59:25","port":37215,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nMAN: \"ssdp:discover\"\r\nMX: 2\r\nST: upnp:rootdevice\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20320d0a53543a2075706e703a726f6f746465766963650d0a0d0a","method":"","user_agent":"","ja3":"","session":"459619cd-aa38-4bc3-9118-5066a916050c","seq":1,"duration_ms":100,"bytes_in":101,"bytes_out":14,"enriched":{"digest":"523b530e827a3937","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","MAN: \"ssdp:discover\"","MX: 2","ST: upnp:rootdevice"],"iocs":{"ips":["239.255.255.250"]}}},{"timestamp":"2026-09-27T16:34:30","port":37215,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nMAN: \"ssdp:discover\"\r\nMX: 2\r\nST: upnp:rootdevice\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20320d0a53543a2075706e703a726f6f746465766963650d0a0d0a","method":"","user_agent":"","ja3":"","session":"cc25d257-31c5-4254-b5a7-178eb92b9bd8","seq":1,"duration_ms":100,"bytes_in":101,"bytes_out":14,"enriched":{"digest":"523b530e827a3937","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","MAN: \"ssdp:discover\"","MX: 2","ST: upnp:rootdevice"],"iocs":{"ips":["239.255.255.250"]}}}],"http_methods":[{"method":"GET","count":3},{"method":"HEAD","count":3}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":3,"ports":1},{"path":"/login.cgi","count":3,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T21:39:55.822124+00:00"}