{"ip":"176.65.149.198","data_as_of":"2026-10-23T08:53:12+00:00","observed":true,"total_events":757,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"other","confidence":"high","network_type":"network services","why":["The address is in a published scanner range (other).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 304 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"16,976 bytes sent","bytes_sent":16976,"session_seconds":30,"persistent":false},"basis":"combined"},"first_seen":"2026-10-05T14:22:11","last_seen":"2026-10-23T07:49:30","events_24h":43,"events_7d":260,"interactive_sessions":304,"interactive_sessions_24h":49,"interactive_sessions_7d":304,"interactive_protocols":[{"protocol":"minecraft","sessions":103}],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Limburg","city":"Eygelshoven","lat":50.8897,"lon":6.0563,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":"176.65.149.198.ptr.pfcloud.network","known_scanners":["other"],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":304,"first_seen":"2026-10-19T06:50:22","last_seen":"2026-10-23T07:27:54","verdicts":[{"verdict":"scan","sessions":304}],"personas":[{"persona":"minecraft@Vanilla 1.21.1","sessions":103}],"services":[{"protocol":"minecraft","port":25565,"sessions":103},{"protocol":"tcp","port":25566,"sessions":6},{"protocol":"tcp","port":25568,"sessions":6},{"protocol":"tcp","port":41949,"sessions":1},{"protocol":"tcp","port":9030,"sessions":1},{"protocol":"tcp","port":41036,"sessions":1},{"protocol":"tcp","port":33430,"sessions":1},{"protocol":"tcp","port":28272,"sessions":1},{"protocol":"tcp","port":25044,"sessions":1},{"protocol":"tcp","port":17057,"sessions":1},{"protocol":"tcp","port":59012,"sessions":1},{"protocol":"tcp","port":64435,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":304}]},"top_ports":[{"port":25565,"proto":"tcp","label":"Minecraft","count":654,"sessions":103},{"port":25568,"proto":"tcp","label":"","count":30,"sessions":6},{"port":25566,"proto":"tcp","label":"","count":25,"sessions":6},{"port":25567,"proto":"tcp","label":"","count":25,"sessions":1},{"port":25569,"proto":"tcp","label":"","count":6,"sessions":0},{"port":25570,"proto":"tcp","label":"","count":5,"sessions":1},{"port":25560,"proto":"tcp","label":"","count":4,"sessions":0},{"port":25561,"proto":"tcp","label":"","count":3,"sessions":0},{"port":25562,"proto":"tcp","label":"","count":3,"sessions":0},{"port":25563,"proto":"tcp","label":"","count":2,"sessions":0},{"port":31903,"proto":"tcp","label":"","count":0,"sessions":1},{"port":49652,"proto":"tcp","label":"","count":0,"sessions":1},{"port":20061,"proto":"tcp","label":"","count":0,"sessions":1},{"port":20652,"proto":"tcp","label":"","count":0,"sessions":1},{"port":3309,"proto":"tcp","label":"","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-05","count":23,"sessions":0},{"date":"2026-10-06","count":49,"sessions":0},{"date":"2026-10-07","count":30,"sessions":0},{"date":"2026-10-08","count":26,"sessions":0},{"date":"2026-10-09","count":47,"sessions":0},{"date":"2026-10-10","count":34,"sessions":0},{"date":"2026-10-11","count":52,"sessions":0},{"date":"2026-10-12","count":40,"sessions":0},{"date":"2026-10-13","count":76,"sessions":0},{"date":"2026-10-14","count":54,"sessions":0},{"date":"2026-10-15","count":45,"sessions":0},{"date":"2026-10-16","count":56,"sessions":0},{"date":"2026-10-17","count":35,"sessions":0},{"date":"2026-10-18","count":38,"sessions":0},{"date":"2026-10-19","count":29,"sessions":61},{"date":"2026-10-20","count":41,"sessions":47},{"date":"2026-10-21","count":29,"sessions":79},{"date":"2026-10-22","count":26,"sessions":103},{"date":"2026-10-23","count":27,"sessions":14}],"recent_events":[{"timestamp":"2026-10-23T07:49:30","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\u0000/\u0007matscan\u00059\u0001\u0001\u0000","payload_hex":"0d002f076d61747363616e0539010100","method":"","user_agent":"","ja3":"","session":"4e782c20-1108-47e3-b38d-2bf38d52e5ba","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14,"enriched":{"digest":"8d8bece8f48ed910","strings":["matscan"]}},{"timestamp":"2026-10-23T07:41:43","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\u0000/\u0007matscan\u00059\u0001\u0001\u0000","payload_hex":"0d002f076d61747363616e0539010100","method":"","user_agent":"","ja3":"","session":"d891aa45-d00b-4d83-ad15-aa3a41184c0c","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14,"enriched":{"digest":"8d8bece8f48ed910","strings":["matscan"]}},{"timestamp":"2026-10-23T07:38:45","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\u0000/\u0007matscan\u00059\u0001\u0001\u0000","payload_hex":"0d002f076d61747363616e0539010100","method":"","user_agent":"","ja3":"","session":"68eae65a-5f5b-446b-9674-74ff33021aac","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14,"enriched":{"digest":"8d8bece8f48ed910","strings":["matscan"]}},{"timestamp":"2026-10-23T07:27:54","port":25565,"proto":"tcp","app_proto":"minecraft","app_protocol":"websocket","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000","payload_hex":"0100","method":"","user_agent":"","ja3":"","session":"a1a0d6dc-1c72-49b9-b0cc-b29673fd1db4-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T07:27:54","port":25565,"proto":"tcp","app_proto":"minecraft","app_protocol":"minecraft","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\u0000/\u0007matscan\u00059\u0001","payload_hex":"0d002f076d61747363616e053901","method":"","user_agent":"","ja3":"","session":"a1a0d6dc-1c72-49b9-b0cc-b29673fd1db4-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"1fe5d4ad4b3ad4c2","strings":["matscan"]},"interactive":true},{"timestamp":"2026-10-23T07:16:59","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\u0000/\u0007matscan\u00059\u0001\u0001\u0000","payload_hex":"0d002f076d61747363616e0539010100","method":"","user_agent":"","ja3":"","session":"4b348b71-405b-4c67-81b2-a6ec987fe3e0","seq":1,"duration_ms":104,"bytes_in":16,"bytes_out":14,"enriched":{"digest":"8d8bece8f48ed910","strings":["matscan"]}},{"timestamp":"2026-10-23T07:13:55","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\u0000/\u0007matscan\u00059\u0001\u0001\u0000","payload_hex":"0d002f076d61747363616e0539010100","method":"","user_agent":"","ja3":"","session":"1c2a1e73-7d46-4bed-9a33-7d356c6aa3c7","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14,"enriched":{"digest":"8d8bece8f48ed910","strings":["matscan"]}},{"timestamp":"2026-10-23T07:09:22","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\u0000/\u0007matscan\u00059\u0001\u0001\u0000","payload_hex":"0d002f076d61747363616e0539010100","method":"","user_agent":"","ja3":"","session":"afb18a37-8329-4dff-9ea8-acbc9fbf2c77","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14,"enriched":{"digest":"8d8bece8f48ed910","strings":["matscan"]}},{"timestamp":"2026-10-23T07:05:42","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\u0000/\u0007matscan\u00059\u0001\u0001\u0000","payload_hex":"0d002f076d61747363616e0539010100","method":"","user_agent":"","ja3":"","session":"5066415c-2628-4e36-9863-ac09d6f5d577","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14,"enriched":{"digest":"8d8bece8f48ed910","strings":["matscan"]}},{"timestamp":"2026-10-23T06:56:58","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\u0000/\u0007matscan\u00059\u0001\u0001\u0000","payload_hex":"0d002f076d61747363616e0539010100","method":"","user_agent":"","ja3":"","session":"8881a512-6430-47c7-b855-80db2eb8f6e5","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":14,"enriched":{"digest":"8d8bece8f48ed910","strings":["matscan"]}}],"http_methods":[],"distinct_ports_total":197,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[]}