{"ip":"176.65.148.153","total_events":708,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"95+ ports swept","confidence":"medium","network_type":"network services","why":["No exploit payloads observed.","Swept 95 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"25,207 bytes sent","bytes_sent":25207,"session_seconds":3,"persistent":false}},"first_seen":"2026-04-01T07:22:41","last_seen":"2026-09-16T10:20:05","events_24h":0,"events_7d":2,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Limburg","city":"Eygelshoven","lat":50.8897,"lon":6.0563,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":"176.65.148.153.ptr.pfcloud.network","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":25565,"proto":"tcp","label":"Minecraft","count":169},{"port":3389,"proto":"tcp","label":"RDP","count":79},{"port":3390,"proto":"tcp","label":"","count":12},{"port":3380,"proto":"tcp","label":"","count":6},{"port":3338,"proto":"tcp","label":"","count":6},{"port":3396,"proto":"tcp","label":"","count":6},{"port":3384,"proto":"tcp","label":"","count":6},{"port":3321,"proto":"tcp","label":"","count":6},{"port":3385,"proto":"tcp","label":"","count":6},{"port":3326,"proto":"tcp","label":"","count":6},{"port":3393,"proto":"tcp","label":"","count":6},{"port":3323,"proto":"tcp","label":"","count":6},{"port":3325,"proto":"tcp","label":"","count":6},{"port":3328,"proto":"tcp","label":"","count":6},{"port":3394,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t10i060500_4dc025c38c38_950472255fe9","t13i221000_231e334592e8_36bf25f296df"],"tls_ja3":["07af4aa9e4d215a5ee63f9a0a277fbe3","8b017ed58d265d4bb85a29a74d48a6d4"],"ja4h":["ge11nn0200_f24fcf356134","ge11nn0100_4740ae6347b0"]},"fingerprint_peers":{"t10i060500_4dc025c38c38_950472255fe9":1,"t13i221000_231e334592e8_36bf25f296df":19,"ge11nn0200_f24fcf356134":58,"ge11nn0100_4740ae6347b0":633},"user_agents":[],"timeline":[{"date":"2026-08-06","count":12},{"date":"2026-08-08","count":4},{"date":"2026-08-09","count":4},{"date":"2026-08-12","count":4},{"date":"2026-08-13","count":4},{"date":"2026-08-15","count":9},{"date":"2026-08-19","count":9},{"date":"2026-08-23","count":9},{"date":"2026-08-27","count":6},{"date":"2026-09-01","count":4},{"date":"2026-09-03","count":65},{"date":"2026-09-04","count":384},{"date":"2026-09-08","count":8},{"date":"2026-09-09","count":2},{"date":"2026-09-10","count":8},{"date":"2026-09-11","count":4},{"date":"2026-09-13","count":1},{"date":"2026-09-16","count":2}],"recent_events":[{"timestamp":"2026-09-16T10:20:05","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.0","alpn":[],"url_path":"/RDWeb/Pages/en-US/login.aspx","summary":"","payload_hex":"474554202f52445765622f50616765732f656e2d55532f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"07af4aa9e4d215a5ee63f9a0a277fbe3","session":"6649afc8-167d-4d2c-833c-b3eb37e38dce","seq":2,"duration_ms":2690,"bytes_in":158,"bytes_out":158},{"timestamp":"2026-09-16T10:20:03","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.0","alpn":[],"url_path":"/RDWeb/Pages/en-US/login.aspx","summary":"","payload_hex":"474554202f52445765622f50616765732f656e2d55532f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"07af4aa9e4d215a5ee63f9a0a277fbe3","session":"6649afc8-167d-4d2c-833c-b3eb37e38dce","seq":1,"duration_ms":583,"bytes_in":91,"bytes_out":79},{"timestamp":"2026-09-13T00:00:30","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/RDWeb/Pages/en-US/login.aspx","summary":"","payload_hex":"474554202f52445765622f50616765732f656e2d55532f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"8b017ed58d265d4bb85a29a74d48a6d4","session":"47266e0b-9c39-4f53-aaba-f46c9ed08dad","seq":1,"duration_ms":100,"bytes_in":67,"bytes_out":79},{"timestamp":"2026-09-11T10:32:04","port":3389,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000%\u0002��d\u0000\u0000\u0003�p�\u0016\u0016\u0000\u0017\u0000�\u0003\u0000\u0000\u0000\u0000\u0000\u0001\b\u0000$\u0000\u0000\u0000\u0001\u0000�\u0003\u0003\u0000\u0000\t\u0002�� \u0003","payload_hex":"0300002502f08064000003eb70801616001700e9030000000000010800240000000100ea030300000902f0802003","method":"","user_agent":"","ja3":"","session":"99a73aa9-8ee1-44eb-8f99-baaafd73587a","seq":2,"duration_ms":111,"bytes_in":88,"bytes_out":28,"enriched":{"digest":"4cb187c097535d03","label":"RDP (X.224)"}},{"timestamp":"2026-09-11T10:32:04","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000*%�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Test\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002a25e00000000000436f6f6b69653a206d737473686173683d546573740d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"99a73aa9-8ee1-44eb-8f99-baaafd73587a","seq":1,"duration_ms":100,"bytes_in":42,"bytes_out":14,"enriched":{"digest":"61a4a68b2724dd6d","label":"RDP (X.224)","strings":["Cookie: mstshash=Test"]}},{"timestamp":"2026-09-11T10:32:04","port":3389,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000%\u0002��d\u0000\u0000\u0003�p�\u0016\u0016\u0000\u0017\u0000�\u0003\u0000\u0000\u0000\u0000\u0000\u0001\b\u0000$\u0000\u0000\u0000\u0001\u0000�\u0003\u0003\u0000\u0000\t\u0002�� \u0003","payload_hex":"0300002502f08064000003eb70801616001700e9030000000000010800240000000100ea030300000902f0802003","method":"","user_agent":"","ja3":"","session":"f8ce18db-0b99-4f4b-850e-02a0c5202d66","seq":2,"duration_ms":258,"bytes_in":88,"bytes_out":28,"enriched":{"digest":"4cb187c097535d03","label":"RDP (X.224)"}},{"timestamp":"2026-09-11T10:32:03","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000*%�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Test\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002a25e00000000000436f6f6b69653a206d737473686173683d546573740d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"f8ce18db-0b99-4f4b-850e-02a0c5202d66","seq":1,"duration_ms":100,"bytes_in":42,"bytes_out":14,"enriched":{"digest":"61a4a68b2724dd6d","label":"RDP (X.224)","strings":["Cookie: mstshash=Test"]}},{"timestamp":"2026-09-10T03:51:09","port":3389,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000%\u0002��d\u0000\u0000\u0003�p�\u0016\u0016\u0000\u0017\u0000�\u0003\u0000\u0000\u0000\u0000\u0000\u0001\b\u0000$\u0000\u0000\u0000\u0001\u0000�\u0003\u0003\u0000\u0000\t\u0002�� \u0003","payload_hex":"0300002502f08064000003eb70801616001700e9030000000000010800240000000100ea030300000902f0802003","method":"","user_agent":"","ja3":"","session":"b664369d-934e-46d0-8d59-47f392389979","seq":2,"duration_ms":197,"bytes_in":88,"bytes_out":28,"enriched":{"digest":"4cb187c097535d03","label":"RDP (X.224)"}},{"timestamp":"2026-09-10T03:51:09","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000*%�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Test\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002a25e00000000000436f6f6b69653a206d737473686173683d546573740d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"b664369d-934e-46d0-8d59-47f392389979","seq":1,"duration_ms":100,"bytes_in":42,"bytes_out":14,"enriched":{"digest":"61a4a68b2724dd6d","label":"RDP (X.224)","strings":["Cookie: mstshash=Test"]}},{"timestamp":"2026-09-10T03:51:09","port":3389,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000%\u0002��d\u0000\u0000\u0003�p�\u0016\u0016\u0000\u0017\u0000�\u0003\u0000\u0000\u0000\u0000\u0000\u0001\b\u0000$\u0000\u0000\u0000\u0001\u0000�\u0003\u0003\u0000\u0000\t\u0002�� \u0003","payload_hex":"0300002502f08064000003eb70801616001700e9030000000000010800240000000100ea030300000902f0802003","method":"","user_agent":"","ja3":"","session":"32600623-439b-4994-a6ac-d3b560779187","seq":2,"duration_ms":197,"bytes_in":88,"bytes_out":28,"enriched":{"digest":"4cb187c097535d03","label":"RDP (X.224)"}}],"http_methods":[{"method":"GET","count":7}],"distinct_ports_total":95,"top_paths":[{"path":"/RDWeb/Pages/en-US/login.aspx","count":7,"ports":3}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host"],"representative":[{"name":"Connection","value":"Keep-Alive","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false}],"distinct_sets":2,"events_with_headers":3},"tags":[],"data_as_of":"2026-09-20T14:45:42.155756+00:00"}