{"ip":"134.209.63.62","total_events":170,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"universities","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (universities).","Known research and commercial scanners are labelled as such, not as threats."]},"first_seen":"2026-03-11T22:21:07","last_seen":"2026-07-07T21:05:30","events_24h":0,"events_7d":3,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Santa Clara","lat":37.3486,"lon":-121.9732,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"research-scan-01.umd-grpc-research.org","known_scanners":["universities"],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"top_ports":[{"port":7233,"proto":"tcp","label":"","count":23},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":21},{"port":50052,"proto":"tcp","label":"","count":21},{"port":2379,"proto":"tcp","label":"","count":18},{"port":8081,"proto":"tcp","label":"","count":15},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":15},{"port":50051,"proto":"tcp","label":"","count":15},{"port":9090,"proto":"tcp","label":"Prometheus","count":15},{"port":17880,"proto":"tcp","label":"","count":12},{"port":80,"proto":"tcp","label":"HTTP","count":9},{"port":15010,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1909h2_9dc949149365_97f8aa674fd9","t13d1910h2_9dc949149365_97f8aa674fd9"],"tls_ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja4h":[]},"fingerprint_peers":{"t13i1909h2_9dc949149365_97f8aa674fd9":952},"user_agents":[],"timeline":[{"date":"2026-04-14","count":21},{"date":"2026-04-16","count":15},{"date":"2026-04-19","count":6},{"date":"2026-04-20","count":6},{"date":"2026-04-21","count":6},{"date":"2026-04-22","count":9},{"date":"2026-04-30","count":15},{"date":"2026-05-05","count":6},{"date":"2026-07-04","count":8},{"date":"2026-07-07","count":3}],"recent_events":[{"timestamp":"2026-07-07T21:05:30","port":2379,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2"],"url_path":"","summary":"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\b\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000","payload_hex":"505249202a20485454502f322e300d0a0d0a534d0d0a0d0a00000004000000000000000408000000000000100000","method":"","user_agent":"","community_id":"1:SYb+6ESJQ0D1P9f55x3E6+O6HGA=","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","session":"a54a188c-9c2c-4ca4-a94f-a38e7f41b2ba","seq":1,"duration_ms":100,"bytes_in":46,"bytes_out":13,"enriched":{"digest":"0c7dbddd9007da71","strings":["PRI * HTTP/2.0"]}},{"timestamp":"2026-07-07T18:29:48","port":2379,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\b\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000","payload_hex":"505249202a20485454502f322e300d0a0d0a534d0d0a0d0a00000004000000000000000408000000000000100000","method":"","user_agent":"","community_id":"1:r5Hk1FBm517o47vBVJhIKhouO84=","ja3":"","session":"c2cf4464-aa70-4e75-a493-4051ceca2ebd","seq":1,"duration_ms":100,"bytes_in":46,"bytes_out":13,"enriched":{"digest":"0c7dbddd9007da71","strings":["PRI * HTTP/2.0"]}},{"timestamp":"2026-07-07T17:14:34","port":2379,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\b\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000","payload_hex":"505249202a20485454502f322e300d0a0d0a534d0d0a0d0a00000004000000000000000408000000000000100000","method":"","user_agent":"","community_id":"1:J9C0Bhgig54CTOryH6gHtvvTAdE=","ja3":"","session":"ee6a1f55-4cc6-4f1a-9efa-e4f8ca32576c","seq":1,"duration_ms":100,"bytes_in":46,"bytes_out":13,"enriched":{"digest":"0c7dbddd9007da71","strings":["PRI * HTTP/2.0"]}},{"timestamp":"2026-07-04T18:43:00","port":7233,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2"],"url_path":"","summary":"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\b\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000","payload_hex":"505249202a20485454502f322e300d0a0d0a534d0d0a0d0a00000004000000000000000408000000000000100000","method":"","user_agent":"","community_id":"1:qLQB+jLUe4jQbfaDYv70g56GNqM=","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","session":"4f0366c9-9c58-424d-8d9e-3dc323f10277","seq":1,"duration_ms":101,"bytes_in":46,"bytes_out":13,"enriched":{"digest":"0c7dbddd9007da71","strings":["PRI * HTTP/2.0"]}},{"timestamp":"2026-07-04T17:44:00","port":7233,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2"],"url_path":"","summary":"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\b\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000","payload_hex":"505249202a20485454502f322e300d0a0d0a534d0d0a0d0a00000004000000000000000408000000000000100000","method":"","user_agent":"","community_id":"1:sMaxbL6/oDfz0qt9JOgN+FF0Yco=","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","session":"50ba8856-ce05-46d5-8447-1f636ebae95c","seq":1,"duration_ms":100,"bytes_in":46,"bytes_out":13,"enriched":{"digest":"0c7dbddd9007da71","strings":["PRI * HTTP/2.0"]}},{"timestamp":"2026-07-04T17:37:26","port":7233,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2"],"url_path":"","summary":"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\b\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000","payload_hex":"505249202a20485454502f322e300d0a0d0a534d0d0a0d0a00000004000000000000000408000000000000100000","method":"","user_agent":"","community_id":"1:opfrlh1kEOHqKYJoO52SxNy2Rfo=","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","session":"790d5454-2d18-411b-be89-997abb3d37b7","seq":1,"duration_ms":100,"bytes_in":46,"bytes_out":13,"enriched":{"digest":"0c7dbddd9007da71","strings":["PRI * HTTP/2.0"]}},{"timestamp":"2026-07-04T17:10:45","port":7233,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2"],"url_path":"","summary":"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\b\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000","payload_hex":"505249202a20485454502f322e300d0a0d0a534d0d0a0d0a00000004000000000000000408000000000000100000","method":"","user_agent":"","community_id":"1:tpQey/viZXAWEL0wjidogM3yyt8=","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","session":"8a02a364-be2f-43ee-9a27-a6288fe23376","seq":1,"duration_ms":100,"bytes_in":46,"bytes_out":13,"enriched":{"digest":"0c7dbddd9007da71","strings":["PRI * HTTP/2.0"]}},{"timestamp":"2026-07-04T16:14:53","port":7233,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\b\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000","payload_hex":"505249202a20485454502f322e300d0a0d0a534d0d0a0d0a00000004000000000000000408000000000000100000","method":"","user_agent":"","community_id":"1:7lj+HoUVOnEzR3oP8wC/G3Uaawk=","ja3":"","session":"7229e3bf-74ae-4436-88ab-778e68f10a71","seq":1,"duration_ms":100,"bytes_in":46,"bytes_out":13,"enriched":{"digest":"0c7dbddd9007da71","strings":["PRI * HTTP/2.0"]}},{"timestamp":"2026-07-04T15:25:32","port":7233,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\b\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000","payload_hex":"505249202a20485454502f322e300d0a0d0a534d0d0a0d0a00000004000000000000000408000000000000100000","method":"","user_agent":"","community_id":"1:LdCA8ya0onp9e2OjTUBz3dXHL90=","ja3":"","session":"9ff40ed0-c8d3-4230-b891-1690033708ad","seq":1,"duration_ms":100,"bytes_in":46,"bytes_out":13,"enriched":{"digest":"0c7dbddd9007da71","strings":["PRI * HTTP/2.0"]}},{"timestamp":"2026-07-04T15:19:47","port":7233,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\b\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000","payload_hex":"505249202a20485454502f322e300d0a0d0a534d0d0a0d0a00000004000000000000000408000000000000100000","method":"","user_agent":"","community_id":"1:wVZ1HpOiVK00XSubMHHUEyFTLCA=","ja3":"","session":"f7e2844f-d867-462b-80b2-23aace75e20c","seq":1,"duration_ms":100,"bytes_in":46,"bytes_out":13,"enriched":{"digest":"0c7dbddd9007da71","strings":["PRI * HTTP/2.0"]}}],"http_methods":[],"distinct_ports_total":11,"top_paths":[],"distinct_paths_total":0,"top_snis":[{"value":"8081","count":9},{"value":"50051","count":9}],"top_hosts":[],"top_alpns":[{"value":"h2","count":107}],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-07-13T06:17:26.630149+00:00"}