{"ip":"139.19.117.195","total_events":81,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"universities","confidence":"high","network_type":"educational/research","why":["Source IP is in a known scanner range (universities).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"909 bytes sent","bytes_sent":909,"session_seconds":0,"persistent":false}},"first_seen":"2026-05-27T14:35:09","last_seen":"2026-08-09T15:45:40","events_24h":0,"events_7d":45,"geo":{"country_code":"DE","country_name":"Germany","region":"Saarland","city":"Saarbrücken","lat":49.2712,"lon":7.0313,"asn":680,"org":"Verein zur Foerderung eines Deutschen Forschungsnetzes e.V."},"source_domain":"inet-research-scan-1.mpi-inf.mpg.de","known_scanners":["universities","MPI-INF internet measurement"],"scanner_tag":{"key":"dfn-research","label":"MPI-INF internet measurement","category":"research","url":""},"cve_matches":[],"malware":[],"top_ports":[{"port":8291,"proto":"tcp","label":"","count":81}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-05-27","count":8},{"date":"2026-05-28","count":28},{"date":"2026-08-09","count":45}],"recent_events":[{"timestamp":"2026-08-09T15:45:40","port":8291,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0002list\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000","payload_hex":"12026c697374000000000000000000ff00000000","method":"","user_agent":"","ja3":"","session":"c7e5628e-4167-4cc2-8f2e-b447a33bc819","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":14,"enriched":{"digest":"c6c1eef784909644","strings":["list"]}},{"timestamp":"2026-08-09T15:42:37","port":8291,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0002list\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000","payload_hex":"12026c697374000000000000000000ff00000000","method":"","user_agent":"","ja3":"","session":"c2351b99-1d84-43b7-8f25-dd01d062ffbf","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":14,"enriched":{"digest":"c6c1eef784909644","strings":["list"]}},{"timestamp":"2026-08-09T15:41:30","port":8291,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0002list\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000","payload_hex":"12026c697374000000000000000000ff00000000","method":"","user_agent":"","ja3":"","session":"5e6bae6f-bb07-4f38-83ba-f65f3cdc685a","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":14,"enriched":{"digest":"c6c1eef784909644","strings":["list"]}},{"timestamp":"2026-08-09T15:41:30","port":8291,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0002list\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000","payload_hex":"12026c697374000000000000000000ff00000000","method":"","user_agent":"","ja3":"","session":"301d3a30-aa63-40ff-9fa5-d596732dd481","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":14,"enriched":{"digest":"c6c1eef784909644","strings":["list"]}},{"timestamp":"2026-08-09T15:41:30","port":8291,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0002list\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000","payload_hex":"12026c697374000000000000000000ff00000000","method":"","user_agent":"","ja3":"","session":"aca92bad-b2e3-4539-a58a-db41d982f0c8","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":14,"enriched":{"digest":"c6c1eef784909644","strings":["list"]}},{"timestamp":"2026-08-09T15:41:30","port":8291,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0002list\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000","payload_hex":"12026c697374000000000000000000ff00000000","method":"","user_agent":"","ja3":"","session":"fedc5726-8e18-4a5a-8ed9-a7285c37c425","seq":1,"duration_ms":101,"bytes_in":20,"bytes_out":14,"enriched":{"digest":"c6c1eef784909644","strings":["list"]}},{"timestamp":"2026-08-09T15:41:30","port":8291,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0002list\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000","payload_hex":"12026c697374000000000000000000ff00000000","method":"","user_agent":"","ja3":"","session":"4c565488-fb12-4994-8295-9f73daa95cff","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":14,"enriched":{"digest":"c6c1eef784909644","strings":["list"]}},{"timestamp":"2026-08-09T15:41:30","port":8291,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0002list\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000","payload_hex":"12026c697374000000000000000000ff00000000","method":"","user_agent":"","ja3":"","session":"f2c0b147-1e13-4ee5-bda3-84281b9acb93","seq":1,"duration_ms":101,"bytes_in":20,"bytes_out":14,"enriched":{"digest":"c6c1eef784909644","strings":["list"]}},{"timestamp":"2026-08-09T15:40:51","port":8291,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0002list\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000","payload_hex":"12026c697374000000000000000000ff00000000","method":"","user_agent":"","ja3":"","session":"9ff851f4-aeb1-4424-a5e0-dc7e923e450c","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":14,"enriched":{"digest":"c6c1eef784909644","strings":["list"]}},{"timestamp":"2026-08-09T15:28:51","port":8291,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0002list\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\n","payload_hex":"12026c69737400000000000000000080000000000a","method":"","user_agent":"","ja3":"","session":"71083f7d-b5bd-4e05-9c07-762a36a830fc","seq":1,"duration_ms":100,"bytes_in":21,"bytes_out":14,"enriched":{"digest":"6a68c66ff1b810d8","strings":["list"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-14T17:52:15.773363+00:00"}