{"ip":"176.65.148.253","data_as_of":"2026-10-24T10:56:56+00:00","observed":true,"total_events":1578,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"other","confidence":"high","network_type":"network services","why":["The address is in a published scanner range (other).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 106,884 interactive session(s) as well as first-packet events.","Interactive sessions: 1 interactive session(s) tried logins, none got in."],"engagement":{"level":"payload","label":"Sustained payload","detail":"1,844,504 bytes sent","bytes_sent":1844504,"session_seconds":30,"persistent":false},"basis":"combined"},"first_seen":"2026-04-30T19:53:13","last_seen":"2026-10-22T18:06:30","events_24h":0,"events_7d":1442,"interactive_sessions":106884,"interactive_sessions_24h":0,"interactive_sessions_7d":106884,"interactive_protocols":[{"protocol":"minecraft","sessions":1792},{"protocol":"http","sessions":17},{"protocol":"http-proxy","sessions":8},{"protocol":"sunrpc","sessions":7},{"protocol":"socks5","sessions":7},{"protocol":"stratum","sessions":6},{"protocol":"elasticsearch-transport","sessions":5},{"protocol":"vnc","sessions":4},{"protocol":"bittorrent","sessions":4},{"protocol":"mikrotik-api","sessions":4},{"protocol":"amqp","sessions":3},{"protocol":"mongodb","sessions":3},{"protocol":"fox","sessions":3},{"protocol":"mqtt","sessions":3},{"protocol":"pptp","sessions":2},{"protocol":"zookeeper","sessions":2},{"protocol":"atg","sessions":2},{"protocol":"winbox","sessions":2},{"protocol":"telnet","sessions":2},{"protocol":"xmpp","sessions":2},{"protocol":"iscsi","sessions":2},{"protocol":"rdp","sessions":2},{"protocol":"postgres","sessions":2},{"protocol":"ssdp","sessions":2},{"protocol":"ssh","sessions":1},{"protocol":"kafka","sessions":1},{"protocol":"smtp","sessions":1},{"protocol":"dnp3","sessions":1},{"protocol":"adb","sessions":1},{"protocol":"mssql","sessions":1},{"protocol":"mysql","sessions":1},{"protocol":"oracle-tns","sessions":1},{"protocol":"cassandra","sessions":1},{"protocol":"ldap","sessions":1},{"protocol":"enip","sessions":1},{"protocol":"giop","sessions":1},{"protocol":"socks4","sessions":1},{"protocol":"rtsp","sessions":1}],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Limburg","city":"Eygelshoven","lat":50.8897,"lon":6.0563,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":"176.65.148.253.ptr.pfcloud.network","known_scanners":["other"],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-41940","title":"cPanel & WHM - Authentication Bypass via Session-File CRLF Injection","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/login/?login_only=1","kev_date_added":"2026-04-30"}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":106884,"first_seen":"2026-10-18T13:33:38","last_seen":"2026-10-22T18:06:30","verdicts":[{"verdict":"scan","sessions":106882},{"verdict":"unknown","sessions":1},{"verdict":"credential","sessions":1}],"personas":[{"persona":"minecraft@Vanilla 1.21.1","sessions":1792},{"persona":"proxy@squid/4.13","sessions":16},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5","sessions":9},{"persona":"nfs@nfs-kernel-server 2.6.1","sessions":7},{"persona":"miner@bfgminer 5.5.0","sessions":6},{"persona":"mikrotik@7.12.1","sessions":6},{"persona":"ics@Schneider Modicon M340","sessions":5},{"persona":"elasticsearch@6.8.23","sessions":5},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5","sessions":4},{"persona":"vnc@RealVNC Server 6.11.0","sessions":4},{"persona":"bittorrent@qBittorrent 4.6.5","sessions":4}],"services":[{"protocol":"minecraft","port":25565,"sessions":1792},{"protocol":"tcp","port":25568,"sessions":102},{"protocol":"tcp","port":25566,"sessions":100},{"protocol":"tcp","port":25567,"sessions":93},{"protocol":"tcp","port":25569,"sessions":74},{"protocol":"tcp","port":25564,"sessions":71},{"protocol":"tcp","port":25563,"sessions":70},{"protocol":"tcp","port":25570,"sessions":65},{"protocol":"tcp","port":25561,"sessions":65},{"protocol":"tcp","port":25562,"sessions":62},{"protocol":"tcp","port":25560,"sessions":62},{"protocol":"tcp","port":24896,"sessions":10}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":106882},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1}]},"top_ports":[{"port":25565,"proto":"tcp","label":"Minecraft","count":716,"sessions":1792},{"port":25568,"proto":"tcp","label":"","count":112,"sessions":102},{"port":25566,"proto":"tcp","label":"","count":112,"sessions":100},{"port":25567,"proto":"tcp","label":"","count":111,"sessions":93},{"port":25564,"proto":"tcp","label":"","count":74,"sessions":71},{"port":25563,"proto":"tcp","label":"","count":73,"sessions":70},{"port":25569,"proto":"tcp","label":"","count":68,"sessions":74},{"port":25561,"proto":"tcp","label":"","count":74,"sessions":65},{"port":25570,"proto":"tcp","label":"","count":72,"sessions":65},{"port":25560,"proto":"tcp","label":"","count":72,"sessions":62},{"port":25562,"proto":"tcp","label":"","count":69,"sessions":62},{"port":24896,"proto":"tcp","label":"","count":0,"sessions":10},{"port":47301,"proto":"tcp","label":"","count":0,"sessions":9},{"port":17027,"proto":"tcp","label":"","count":0,"sessions":9},{"port":4756,"proto":"tcp","label":"","count":0,"sessions":9}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i4311h1_c7886603b240_b26ce05bbdd6"],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cuq070_00050817_9c017ed9","b11cun050_00040017_97f1d74f","b11cun030_00040012_13ee3d34","b11cuq110_10050c3f_d112b38d"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i4311h1_c7886603b240_b26ce05bbdd6":25,"b11cuq070_00050817_9c017ed9":8,"b11cun050_00040017_97f1d74f":41,"b11cun030_00040012_13ee3d34":5341,"b11cuq110_10050c3f_d112b38d":2},"akin_families":{"b11cun050_00040017_97f1d74f":{"head":"b11cun050_00040017_97f1d74f","shapes":3,"ips":41},"b11cun030_00040012_13ee3d34":{"head":"b11cun030_00040012_13ee3d34","shapes":2,"ips":5336}},"user_agents":["python-requests/2.25.1","Go-http-client/1.1","Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0"],"timeline":[{"date":"2026-10-10","count":1,"sessions":0},{"date":"2026-10-12","count":51,"sessions":0},{"date":"2026-10-13","count":36,"sessions":0},{"date":"2026-10-14","count":25,"sessions":0},{"date":"2026-10-15","count":8,"sessions":0},{"date":"2026-10-16","count":8,"sessions":0},{"date":"2026-10-17","count":13,"sessions":0},{"date":"2026-10-18","count":119,"sessions":7939},{"date":"2026-10-19","count":284,"sessions":19228},{"date":"2026-10-20","count":354,"sessions":35981},{"date":"2026-10-21","count":404,"sessions":27737},{"date":"2026-10-22","count":269,"sessions":15999}],"recent_events":[{"timestamp":"2026-10-22T18:06:29","port":25565,"proto":"tcp","app_proto":"minecraft","app_protocol":"websocket","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000","payload_hex":"0100","method":"","user_agent":"","ja3":"","session":"eaf00403-379a-425f-8477-30dc7bbb09e1-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T18:06:29","port":25565,"proto":"tcp","app_proto":"minecraft","app_protocol":"minecraft","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u000e\u0000�\u0006\u0007matscanc�\u0001","payload_hex":"0e008506076d61747363616e63dd01","method":"","user_agent":"","ja3":"","session":"eaf00403-379a-425f-8477-30dc7bbb09e1-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"98d4376b7d7bd322","strings":["matscanc"]},"interactive":true},{"timestamp":"2026-10-22T18:05:45","port":25565,"proto":"tcp","app_proto":"minecraft","app_protocol":"websocket","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000","payload_hex":"0100","method":"","user_agent":"","ja3":"","session":"2d7f1fc4-3900-4ad9-b069-6a5a3e46fbfc-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T18:05:45","port":25565,"proto":"tcp","app_proto":"minecraft","app_protocol":"minecraft","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u000e\u0000�\u0006\u0007matscanc�\u0001","payload_hex":"0e008506076d61747363616e63dd01","method":"","user_agent":"","ja3":"","session":"2d7f1fc4-3900-4ad9-b069-6a5a3e46fbfc-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"98d4376b7d7bd322","strings":["matscanc"]},"interactive":true},{"timestamp":"2026-10-22T18:05:09","port":25565,"proto":"tcp","app_proto":"minecraft","app_protocol":"websocket","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000","payload_hex":"0100","method":"","user_agent":"","ja3":"","session":"a78b4249-418a-4f74-9e9d-3f228607e952-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T18:05:09","port":25565,"proto":"tcp","app_proto":"minecraft","app_protocol":"minecraft","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u000e\u0000�\u0006\u0007matscanc�\u0001","payload_hex":"0e008506076d61747363616e63dd01","method":"","user_agent":"","ja3":"","session":"a78b4249-418a-4f74-9e9d-3f228607e952-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"98d4376b7d7bd322","strings":["matscanc"]},"interactive":true},{"timestamp":"2026-10-22T18:02:15","port":25565,"proto":"tcp","app_proto":"minecraft","app_protocol":"websocket","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000","payload_hex":"0100","method":"","user_agent":"","ja3":"","session":"5d22dd53-ee2e-4c3e-938d-0ca9335de9e7-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T18:02:15","port":25565,"proto":"tcp","app_proto":"minecraft","app_protocol":"minecraft","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u000e\u0000�\u0006\u0007matscanc�\u0001","payload_hex":"0e008506076d61747363616e63dd01","method":"","user_agent":"","ja3":"","session":"5d22dd53-ee2e-4c3e-938d-0ca9335de9e7-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"98d4376b7d7bd322","strings":["matscanc"]},"interactive":true},{"timestamp":"2026-10-22T18:01:47","port":25565,"proto":"tcp","app_proto":"minecraft","app_protocol":"websocket","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000","payload_hex":"0100","method":"","user_agent":"","ja3":"","session":"9a53ee02-15b2-406c-a00c-3c73bbad881a-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T18:01:47","port":25565,"proto":"tcp","app_proto":"minecraft","app_protocol":"minecraft","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u000e\u0000�\u0006\u0007matscanc�\u0001","payload_hex":"0e008506076d61747363616e63dd01","method":"","user_agent":"","ja3":"","session":"9a53ee02-15b2-406c-a00c-3c73bbad881a-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"98d4376b7d7bd322","strings":["matscanc"]},"interactive":true}],"http_methods":[{"method":"GET","count":3},{"method":"POST","count":2}],"distinct_ports_total":51866,"top_paths":[{"path":"/","count":17,"ports":9},{"path":"/login","count":2,"ports":1},{"path":"/login/?login_only=1","count":1,"ports":1},{"path":"/openid_connect/cpanelid","count":1,"ports":1},{"path":"/boaform/admin/formLogin","count":1,"ports":1}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":3}],"banners":[],"credentials":[{"username":"admin","password":"","count":1}],"header_profile":null,"tags":[{"tag_id":"CVE-2026-41940","tag_type":"cve","title":"cPanel & WHM - Authentication Bypass via Session-File CRLF Injection","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/login/?login_only=1","reference_urls":[],"kev_date_added":"2026-04-30"},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}