{"ip":"176.65.149.152","total_events":5119,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"24+ ports swept","confidence":"medium","network_type":"network services","why":["No exploit payloads observed.","Swept 24 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Held a session open for 305s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"5,648,650 bytes sent, longest session 305s","bytes_sent":5648650,"session_seconds":305,"persistent":true}},"first_seen":"2026-09-27T20:24:24","last_seen":"2026-09-28T03:57:43","events_24h":5062,"events_7d":5119,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Limburg","city":"Eygelshoven","lat":50.8897,"lon":6.0563,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":"176.65.149.152.ptr.pfcloud.network","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":12345,"proto":"tcp","label":"","count":802},{"port":6767,"proto":"tcp","label":"","count":681},{"port":2345,"proto":"tcp","label":"","count":681},{"port":12321,"proto":"tcp","label":"","count":544},{"port":9999,"proto":"tcp","label":"","count":409},{"port":9001,"proto":"tcp","label":"Tor","count":273},{"port":1999,"proto":"tcp","label":"","count":272},{"port":2002,"proto":"tcp","label":"","count":272},{"port":10001,"proto":"tcp","label":"","count":272},{"port":1337,"proto":"tcp","label":"","count":272},{"port":2323,"proto":"tcp","label":"","count":201},{"port":7777,"proto":"tcp","label":"Oracle","count":137},{"port":2001,"proto":"tcp","label":"","count":136},{"port":4444,"proto":"tcp","label":"","count":136},{"port":23,"proto":"tcp","label":"Telnet","count":18}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["a11cun040_0000004d_4110f156"]},"fingerprint_peers":{"a11cun040_0000004d_4110f156":38},"akin_families":{"a11cun040_0000004d_4110f156":{"head":"a11cun040_0000004d_4110f156","shapes":2,"ips":38}},"user_agents":["curl/7.88.1"],"timeline":[{"date":"2026-09-27","count":1683},{"date":"2026-09-28","count":3436}],"recent_events":[{"timestamp":"2026-09-28T03:57:43","port":2323,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"fin\r\n","payload_hex":"66696e0d0a","method":"","user_agent":"","ja3":"","session":"81db0759-ad03-411e-9f38-b4d16e930d7a","seq":2,"duration_ms":2299,"bytes_in":12,"bytes_out":31},{"timestamp":"2026-09-28T03:57:41","port":2323,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"admin\r\n","payload_hex":"61646d696e0d0a","method":"","user_agent":"","ja3":"","session":"81db0759-ad03-411e-9f38-b4d16e930d7a","seq":1,"duration_ms":100,"bytes_in":7,"bytes_out":12,"enriched":{"digest":"86ff11bd7933c00a","strings":["admin"]}},{"timestamp":"2026-09-28T03:57:38","port":2323,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"fin\r\n","payload_hex":"66696e0d0a","method":"","user_agent":"","ja3":"","session":"5e29ae21-99da-4800-9d32-4b36aa956be4","seq":2,"duration_ms":2299,"bytes_in":10,"bytes_out":31},{"timestamp":"2026-09-28T03:57:36","port":2323,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"fin\r\n","payload_hex":"66696e0d0a","method":"","user_agent":"","ja3":"","session":"5e29ae21-99da-4800-9d32-4b36aa956be4","seq":1,"duration_ms":101,"bytes_in":5,"bytes_out":12},{"timestamp":"2026-09-28T03:57:33","port":2323,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"password\r\n","payload_hex":"70617373776f72640d0a","method":"","user_agent":"","ja3":"","session":"efcba7bd-85a9-4679-bf4c-bec4d6dc5f27","seq":2,"duration_ms":2303,"bytes_in":17,"bytes_out":31,"enriched":{"digest":"0bd181063899c923","strings":["password"]}},{"timestamp":"2026-09-28T03:57:31","port":2323,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"admin\r\n","payload_hex":"61646d696e0d0a","method":"","user_agent":"","ja3":"","session":"efcba7bd-85a9-4679-bf4c-bec4d6dc5f27","seq":1,"duration_ms":100,"bytes_in":7,"bytes_out":12,"enriched":{"digest":"86ff11bd7933c00a","strings":["admin"]}},{"timestamp":"2026-09-28T03:57:28","port":2323,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"admin123\r\n","payload_hex":"61646d696e3132330d0a","method":"","user_agent":"","ja3":"","session":"5835e485-9b94-4fa4-85fa-a11a93477059","seq":2,"duration_ms":2298,"bytes_in":17,"bytes_out":31,"enriched":{"digest":"2e1b5ac2637a0d8d","strings":["admin123"]}},{"timestamp":"2026-09-28T03:57:26","port":2323,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"admin\r\n","payload_hex":"61646d696e0d0a","method":"","user_agent":"","ja3":"","session":"5835e485-9b94-4fa4-85fa-a11a93477059","seq":1,"duration_ms":100,"bytes_in":7,"bytes_out":12,"enriched":{"digest":"86ff11bd7933c00a","strings":["admin"]}},{"timestamp":"2026-09-28T03:57:23","port":2323,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"123456\r\n","payload_hex":"3132333435360d0a","method":"","user_agent":"","ja3":"","session":"118f48d6-8488-4944-8b35-d67e585a80cb","seq":2,"duration_ms":2298,"bytes_in":15,"bytes_out":31,"enriched":{"digest":"685414bd2b15a3a5","strings":["123456"]}},{"timestamp":"2026-09-28T03:57:21","port":2323,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"admin\r\n","payload_hex":"61646d696e0d0a","method":"","user_agent":"","ja3":"","session":"118f48d6-8488-4944-8b35-d67e585a80cb","seq":1,"duration_ms":100,"bytes_in":7,"bytes_out":12,"enriched":{"digest":"86ff11bd7933c00a","strings":["admin"]}}],"http_methods":[{"method":"GET","count":6}],"distinct_ports_total":24,"top_paths":[{"path":"/bins/mirai.arm7","count":6,"ports":3}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-28T21:33:20.523160+00:00"}