{"ip":"176.65.148.216","total_events":540,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"540 events across 1 port(s)","confidence":"medium","network_type":"network services","why":["540 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"21,474 bytes sent","bytes_sent":21474,"session_seconds":16,"persistent":false}},"first_seen":"2026-06-02T20:08:45","last_seen":"2026-08-15T17:30:05","events_24h":18,"events_7d":72,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Limburg","city":"Eygelshoven","lat":50.8897,"lon":6.0563,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":"176.65.148.216.ptr.pfcloud.network","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":25565,"proto":"tcp","label":"Minecraft","count":540}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-06-02","count":9},{"date":"2026-06-03","count":9},{"date":"2026-06-04","count":18},{"date":"2026-06-05","count":18},{"date":"2026-06-06","count":3},{"date":"2026-06-07","count":6},{"date":"2026-06-08","count":6},{"date":"2026-06-09","count":9},{"date":"2026-06-10","count":6},{"date":"2026-06-11","count":15},{"date":"2026-06-12","count":9},{"date":"2026-06-14","count":6},{"date":"2026-06-15","count":9},{"date":"2026-06-16","count":6},{"date":"2026-06-17","count":9},{"date":"2026-06-19","count":9},{"date":"2026-06-20","count":9},{"date":"2026-06-21","count":9},{"date":"2026-06-22","count":9},{"date":"2026-06-23","count":9},{"date":"2026-06-24","count":6},{"date":"2026-06-25","count":9},{"date":"2026-06-26","count":9},{"date":"2026-06-27","count":6},{"date":"2026-06-29","count":6},{"date":"2026-06-30","count":9},{"date":"2026-07-01","count":6},{"date":"2026-07-02","count":9},{"date":"2026-07-03","count":9},{"date":"2026-07-04","count":9},{"date":"2026-07-06","count":9},{"date":"2026-07-07","count":18},{"date":"2026-07-09","count":9},{"date":"2026-07-10","count":6},{"date":"2026-07-12","count":9},{"date":"2026-07-18","count":9},{"date":"2026-07-26","count":15},{"date":"2026-07-27","count":9},{"date":"2026-07-28","count":9},{"date":"2026-07-29","count":18},{"date":"2026-07-30","count":6},{"date":"2026-07-31","count":12},{"date":"2026-08-01","count":15},{"date":"2026-08-02","count":15},{"date":"2026-08-03","count":12},{"date":"2026-08-04","count":12},{"date":"2026-08-05","count":9},{"date":"2026-08-07","count":6},{"date":"2026-08-08","count":9},{"date":"2026-08-09","count":9},{"date":"2026-08-10","count":18},{"date":"2026-08-11","count":9},{"date":"2026-08-12","count":9},{"date":"2026-08-14","count":9},{"date":"2026-08-15","count":18}],"recent_events":[{"timestamp":"2026-08-15T17:30:05","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013\u0000/\r<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"13002f0d<HONEYPOT>63dd010100","method":"","user_agent":"","ja3":"","session":"23814b07-98fb-4cda-869f-5afeabe3a2db","seq":3,"duration_ms":11322,"bytes_in":66,"bytes_out":42,"enriched":{"digest":"a1742bbe7ffa52ed","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-08-15T17:30:00","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013\u0000/\r<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"13002f0d<HONEYPOT>63dd010100","method":"","user_agent":"","ja3":"","session":"23814b07-98fb-4cda-869f-5afeabe3a2db","seq":2,"duration_ms":5710,"bytes_in":44,"bytes_out":28,"enriched":{"digest":"a1742bbe7ffa52ed","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-08-15T17:29:54","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013\u0000/\r<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"13002f0d<HONEYPOT>63dd010100","method":"","user_agent":"","ja3":"","session":"23814b07-98fb-4cda-869f-5afeabe3a2db","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":14,"enriched":{"digest":"a1742bbe7ffa52ed","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-08-15T17:27:52","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0000/\f<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"12002f0c<HONEYPOT>63dd010100","method":"","user_agent":"","ja3":"","session":"03c1d644-add5-444b-b1db-1d74f8e286e6","seq":3,"duration_ms":11494,"bytes_in":63,"bytes_out":42,"enriched":{"digest":"fc4072c0fc6e3f76","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-08-15T17:27:46","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0000/\f<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"12002f0c<HONEYPOT>63dd010100","method":"","user_agent":"","ja3":"","session":"03c1d644-add5-444b-b1db-1d74f8e286e6","seq":2,"duration_ms":5797,"bytes_in":42,"bytes_out":28,"enriched":{"digest":"fc4072c0fc6e3f76","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-08-15T17:27:40","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0000/\f<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"12002f0c<HONEYPOT>63dd010100","method":"","user_agent":"","ja3":"","session":"03c1d644-add5-444b-b1db-1d74f8e286e6","seq":1,"duration_ms":100,"bytes_in":21,"bytes_out":14,"enriched":{"digest":"fc4072c0fc6e3f76","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-08-15T17:24:43","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0000/\f<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"12002f0c<HONEYPOT>63dd010100","method":"","user_agent":"","ja3":"","session":"9edb38c4-f9f2-40b9-b4b5-43e5cda28b46","seq":3,"duration_ms":11496,"bytes_in":63,"bytes_out":42,"enriched":{"digest":"fc4072c0fc6e3f76","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-08-15T17:24:38","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0000/\f<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"12002f0c<HONEYPOT>63dd010100","method":"","user_agent":"","ja3":"","session":"9edb38c4-f9f2-40b9-b4b5-43e5cda28b46","seq":2,"duration_ms":5799,"bytes_in":42,"bytes_out":28,"enriched":{"digest":"fc4072c0fc6e3f76","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-08-15T17:24:32","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0000/\f<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"12002f0c<HONEYPOT>63dd010100","method":"","user_agent":"","ja3":"","session":"9edb38c4-f9f2-40b9-b4b5-43e5cda28b46","seq":1,"duration_ms":101,"bytes_in":21,"bytes_out":14,"enriched":{"digest":"fc4072c0fc6e3f76","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-08-15T03:55:01","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013\u0000/\r<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"13002f0d<HONEYPOT>63dd010100","method":"","user_agent":"","ja3":"","session":"60bed79b-5101-4652-98af-79bfc0a9a900","seq":3,"duration_ms":11329,"bytes_in":66,"bytes_out":42,"enriched":{"digest":"a1742bbe7ffa52ed","strings":["<HONEYPOT>c"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T20:37:06.766193+00:00"}