{"ip":"130.226.254.28","total_events":46,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"universities","confidence":"high","network_type":"educational/research","why":["Source IP is in a known scanner range (universities).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"7,360 bytes sent","bytes_sent":7360,"session_seconds":0,"persistent":false}},"first_seen":"2026-05-22T23:52:25","last_seen":"2026-08-11T18:58:40","events_24h":0,"events_7d":40,"geo":{"country_code":"DK","country_name":"Denmark","region":"","city":"","lat":55.7123,"lon":12.0564,"asn":1835,"org":"IDDQD-AS"},"source_domain":"dtuscanner.compute.dtu.dk","known_scanners":["universities","Forskningsnettet"],"scanner_tag":{"key":"peeringdb:as1835","label":"Forskningsnettet","category":"research","url":"https://www.peeringdb.com/asn/1835"},"cve_matches":[],"malware":[],"top_ports":[{"port":4242,"proto":"tcp","label":"","count":8},{"port":2762,"proto":"tcp","label":"","count":8},{"port":2761,"proto":"tcp","label":"","count":8},{"port":11112,"proto":"tcp","label":"","count":8},{"port":104,"proto":"tcp","label":"","count":8},{"port":2575,"proto":"tcp","label":"","count":3},{"port":2576,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-05-22","count":2},{"date":"2026-05-23","count":4},{"date":"2026-08-11","count":40}],"recent_events":[{"timestamp":"2026-08-11T18:58:40","port":2761,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP         DTU-SCANNER     \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000�\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000\u001fQ\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\t1.2.3.4.5U\u0000\u0000\u0006ZGRAB2","payload_hex":"0100000000b200010000414e592d5343502020202020202020204454552d5343414e4e45522020202020000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100ff0030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000001f510000040000400052000009312e322e332e342e35550000065a4752414232","method":"","user_agent":"","ja3":"","session":"76323f42-17fd-48ce-be91-0f6ad8052207","seq":1,"duration_ms":100,"bytes_in":184,"bytes_out":14,"enriched":{"digest":"2db3aa3ab49b055d","label":"DICOM","strings":["ANY-SCP         DTU-SCANNER","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.3.4.5U","ZGRAB2","1.2.840.10008.3.1.1.1 ."]}},{"timestamp":"2026-08-11T18:58:40","port":11112,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP         DTU-SCANNER     \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000�\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000\u001fQ\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\t1.2.3.4.5U\u0000\u0000\u0006ZGRAB2","payload_hex":"0100000000b200010000414e592d5343502020202020202020204454552d5343414e4e45522020202020000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100ff0030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000001f510000040000400052000009312e322e332e342e35550000065a4752414232","method":"","user_agent":"","ja3":"","session":"26fd6bbe-ffef-4f35-8bd1-b1ccfe6316ec","seq":1,"duration_ms":101,"bytes_in":184,"bytes_out":14,"enriched":{"digest":"2db3aa3ab49b055d","label":"DICOM","strings":["ANY-SCP         DTU-SCANNER","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.3.4.5U","ZGRAB2","1.2.840.10008.3.1.1.1 ."]}},{"timestamp":"2026-08-11T18:58:40","port":104,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP         DTU-SCANNER     \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000�\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000\u001fQ\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\t1.2.3.4.5U\u0000\u0000\u0006ZGRAB2","payload_hex":"0100000000b200010000414e592d5343502020202020202020204454552d5343414e4e45522020202020000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100ff0030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000001f510000040000400052000009312e322e332e342e35550000065a4752414232","method":"","user_agent":"","ja3":"","session":"928e9f02-e3f1-497a-a77e-b3a14cafd6a4","seq":1,"duration_ms":100,"bytes_in":184,"bytes_out":14,"enriched":{"digest":"2db3aa3ab49b055d","label":"DICOM","strings":["ANY-SCP         DTU-SCANNER","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.3.4.5U","ZGRAB2","1.2.840.10008.3.1.1.1 ."]}},{"timestamp":"2026-08-11T18:58:40","port":4242,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP         DTU-SCANNER     \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000�\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000\u001fQ\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\t1.2.3.4.5U\u0000\u0000\u0006ZGRAB2","payload_hex":"0100000000b200010000414e592d5343502020202020202020204454552d5343414e4e45522020202020000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100ff0030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000001f510000040000400052000009312e322e332e342e35550000065a4752414232","method":"","user_agent":"","ja3":"","session":"8e5c13a1-ffb8-4f03-91b0-c8bac4338e70","seq":1,"duration_ms":101,"bytes_in":184,"bytes_out":14,"enriched":{"digest":"2db3aa3ab49b055d","label":"DICOM","strings":["ANY-SCP         DTU-SCANNER","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.3.4.5U","ZGRAB2","1.2.840.10008.3.1.1.1 ."]}},{"timestamp":"2026-08-11T18:58:40","port":2762,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP         DTU-SCANNER     \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000�\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000\u001fQ\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\t1.2.3.4.5U\u0000\u0000\u0006ZGRAB2","payload_hex":"0100000000b200010000414e592d5343502020202020202020204454552d5343414e4e45522020202020000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100ff0030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000001f510000040000400052000009312e322e332e342e35550000065a4752414232","method":"","user_agent":"","ja3":"","session":"d817fd56-97bd-4ec3-87de-3cb39a7f644f","seq":1,"duration_ms":100,"bytes_in":184,"bytes_out":14,"enriched":{"digest":"2db3aa3ab49b055d","label":"DICOM","strings":["ANY-SCP         DTU-SCANNER","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.3.4.5U","ZGRAB2","1.2.840.10008.3.1.1.1 ."]}},{"timestamp":"2026-08-11T18:58:40","port":11112,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP         DTU-SCANNER     \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000�\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000\u001fQ\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\t1.2.3.4.5U\u0000\u0000\u0006ZGRAB2","payload_hex":"0100000000b200010000414e592d5343502020202020202020204454552d5343414e4e45522020202020000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100ff0030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000001f510000040000400052000009312e322e332e342e35550000065a4752414232","method":"","user_agent":"","ja3":"","session":"93eb22cf-44ba-4433-865b-270b9cc5bd8c","seq":1,"duration_ms":101,"bytes_in":184,"bytes_out":14,"enriched":{"digest":"2db3aa3ab49b055d","label":"DICOM","strings":["ANY-SCP         DTU-SCANNER","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.3.4.5U","ZGRAB2","1.2.840.10008.3.1.1.1 ."]}},{"timestamp":"2026-08-11T18:58:40","port":104,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP         DTU-SCANNER     \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000�\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000\u001fQ\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\t1.2.3.4.5U\u0000\u0000\u0006ZGRAB2","payload_hex":"0100000000b200010000414e592d5343502020202020202020204454552d5343414e4e45522020202020000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100ff0030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000001f510000040000400052000009312e322e332e342e35550000065a4752414232","method":"","user_agent":"","ja3":"","session":"dc69d040-0a3d-495d-8845-6b285368eecc","seq":1,"duration_ms":101,"bytes_in":184,"bytes_out":14,"enriched":{"digest":"2db3aa3ab49b055d","label":"DICOM","strings":["ANY-SCP         DTU-SCANNER","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.3.4.5U","ZGRAB2","1.2.840.10008.3.1.1.1 ."]}},{"timestamp":"2026-08-11T18:58:40","port":2761,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP         DTU-SCANNER     \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000�\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000\u001fQ\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\t1.2.3.4.5U\u0000\u0000\u0006ZGRAB2","payload_hex":"0100000000b200010000414e592d5343502020202020202020204454552d5343414e4e45522020202020000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100ff0030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000001f510000040000400052000009312e322e332e342e35550000065a4752414232","method":"","user_agent":"","ja3":"","session":"33d8dfcd-8f27-44e8-b22c-f2d7f9156122","seq":1,"duration_ms":101,"bytes_in":184,"bytes_out":14,"enriched":{"digest":"2db3aa3ab49b055d","label":"DICOM","strings":["ANY-SCP         DTU-SCANNER","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.3.4.5U","ZGRAB2","1.2.840.10008.3.1.1.1 ."]}},{"timestamp":"2026-08-11T18:58:40","port":2762,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP         DTU-SCANNER     \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000�\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000\u001fQ\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\t1.2.3.4.5U\u0000\u0000\u0006ZGRAB2","payload_hex":"0100000000b200010000414e592d5343502020202020202020204454552d5343414e4e45522020202020000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100ff0030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000001f510000040000400052000009312e322e332e342e35550000065a4752414232","method":"","user_agent":"","ja3":"","session":"8bcbfb72-d1fd-47e4-9cd3-c1e0763126ed","seq":1,"duration_ms":101,"bytes_in":184,"bytes_out":14,"enriched":{"digest":"2db3aa3ab49b055d","label":"DICOM","strings":["ANY-SCP         DTU-SCANNER","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.3.4.5U","ZGRAB2","1.2.840.10008.3.1.1.1 ."]}},{"timestamp":"2026-08-11T18:58:40","port":4242,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP         DTU-SCANNER     \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000�\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000\u001fQ\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\t1.2.3.4.5U\u0000\u0000\u0006ZGRAB2","payload_hex":"0100000000b200010000414e592d5343502020202020202020204454552d5343414e4e45522020202020000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100ff0030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000001f510000040000400052000009312e322e332e342e35550000065a4752414232","method":"","user_agent":"","ja3":"","session":"dc572278-5ae9-4bb0-81ea-b7081addbea6","seq":1,"duration_ms":100,"bytes_in":184,"bytes_out":14,"enriched":{"digest":"2db3aa3ab49b055d","label":"DICOM","strings":["ANY-SCP         DTU-SCANNER","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.3.4.5U","ZGRAB2","1.2.840.10008.3.1.1.1 ."]}}],"http_methods":[],"distinct_ports_total":7,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T09:47:40.259954+00:00"}