I found a weird IP address on my network that had transmitted an insanely small amount of data. I put the address in my browser and got this. what the heck am I looking at?

It's the default page for a Windows Server running IIS web server.

As everyone else has said this is the out of the box default page that comes with Microsoft IIS web server on windows server.

Though I feel like you'd know if you had a copy of windows server running on your network somewhere—is the IP in your usual network subnet?

So, as others have saId this is just an unconfigured IIS server, which implies it's either a windows machine, or a windows based VM, well or someone put the default IIS files on another server, but that's unlikely.

When you say "weird" IP I'd wonder what you mean by that.

I think since it's probably a windows machine, from another windows machine typing nbtstat -A <ip> should give you the computer name and workgroup or domain they belong to. See if it matches anything you expect on your network.

If not, maybe it's time to change your WPA wifi key.

The default home page for Microsoft IIS, the web server built into Windows Server (and probably some desktop builds too).

Following, I want to know what god awful iot device this is. Refrigerator? Toaster oven? Vibrating dildo? The suspense is killing me

Bro, you gotta keep us updated, I'm surprisingly invested in this now.

If you can, power stuff off and check if that web page is still available. Start with any Windows machines. It could be a virtual machine running inside of something else though.

Edit: here's how to disable that web server https://superuser.com/a/1377078 . I'd do that on any Windows machines as well.

does your router give you the MAC address of the device? You can look it up to see who manufactured it and then narrow down. This could be a device that has a web service running is all you are seeing right now.

Windows IIS probably from around the time of windows 8 so maybe 2012. Probably running on either windows server 2012 (like exchange, an active directory domain controller, or if you are unlucky sharepoint) or some weirdly configured appliance running windows 8 ish enterprise.

Others haven't suggested this yet, but a single device, like your laptop, even with one connection, can have two IPs.

This is where you find that shit is so bloated and pointlessly connected that it's running on a washing machine.

Home network or corporate?

Its a windows server, if you are using widows too you can try establishing a RDP connection with Remote Desktop Connection.

How insanely small was the transfer? Like 1 bit?

There was an appliance where the wifi chip was at the end of the power cable, embedded inside the plug. From the outside, you couldn't really tell. It was there so radiation inside the box couldn't affect the wireless signal as much.

I can imagine some genius thinking it's a good idea to run a server from inside a cable or a connected home appliance.

Get the MAC address from the ARP table, and look up the OIN, should help you determine if it's virtual or physical, and if physical the type of NIC it's using.

Depending on your router, it could have a docker setup with Windows on it. I've seen some strange shit on cheap routers with far too much processing power and storage.

nmap -A -T4 -p- <IP>

That is IIS, all it means is you are probably talking to a windows server. Is the traffic encrypted? What port is it going to?

It's me. I'm your nextdoor neighbour. Sorry!

You don't have Ethernet over power do you?

Fun story, I live in a townhome, I had so bizarre network issues going on. Not able to stream to TV etc. finally started unplugging shit. Unplugged the router and saw the computer still happily downloading something WTF! Turns out a neighbor also had Ethernet over power and devices were randomly connecting to their network. Crazy ass shit.

Windows 8 is starting to break out

Is your IP adres same as localhost and you are using Windows Pro, then probably IIS is installed on your device.

Maybe set up Kismet https://www.kismetwireless.net/

That'll show devices attempting to break in wirelessly

Besides the MAC lookup suggestion, have you tried to simply find hostname in local DNS by reverse IP lookup, maybe that would shed some light.

Not sure if there is anything useful, but in browser just check site source, maybe there is something useful there that could help with identification. Does site have certificate? Do the standard browser network trace via dev tools F12, maybe something useful appears there.

In nmap you can attempt to guess OS, try that. Additionally it might be possible to get hostname as well.

And have you checked your router to see if this connection is connected to your Wi-Fi AP or Ethernet to narrow things down? If it is not possible to determine this from router, simply connect your main PC to Ethernet, disable AP in router settings and check if IIS site is still up. If it is not, enable AP again, does it come back early or it takes some time?

Lastly, if it still is a mystery, start powering off devices one by one to find the source. Based on comments it seems you have multiple devices, but I assume it would not take that long?

... So when you port scanned it, IIS was gone?

You're looking at my worst nightmare 😅

I would download metasploit and dig up some interesting exploits to try against it.

Maybe try traceroutre or lft (layer 4 traceroutre) to see if something wacky is happening with routing in your lan?

Idk looks like Mexico rendered out of windows 8 tiles telling you welcome.

nmap's seeing the 1-9999 as the next argument (expecting an IP address). In -Pn, the n is a placeholder for the port numbers you want to scan, so you want -P1-9999