{"ip":"141.22.28.227","total_events":114,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"universities","confidence":"high","network_type":"educational/research","why":["Source IP is in a known scanner range (universities).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"1,890 bytes sent","bytes_sent":1890,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-23T01:56:04","last_seen":"2026-08-10T08:11:03","events_24h":0,"events_7d":3,"geo":{"country_code":"DE","country_name":"Germany","region":"Lower Saxony","city":"Lindhorst","lat":52.3582,"lon":9.2801,"asn":680,"org":"Verein zur Foerderung eines Deutschen Forschungsnetzes e.V."},"source_domain":"research-scan1.inet.haw-hamburg.de","known_scanners":["universities","Academic internet measurement"],"scanner_tag":{"key":"dfn-research","label":"Academic internet measurement","category":"research","url":""},"cve_matches":[],"malware":[],"top_ports":[{"port":53,"proto":"tcp","label":"DNS","count":114}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-05-17","count":1},{"date":"2026-05-18","count":2},{"date":"2026-05-24","count":1},{"date":"2026-05-25","count":2},{"date":"2026-05-31","count":1},{"date":"2026-06-01","count":3},{"date":"2026-06-07","count":1},{"date":"2026-06-08","count":2},{"date":"2026-06-15","count":3},{"date":"2026-06-21","count":2},{"date":"2026-06-22","count":2},{"date":"2026-06-29","count":4},{"date":"2026-07-06","count":4},{"date":"2026-07-12","count":2},{"date":"2026-07-13","count":2},{"date":"2026-07-19","count":1},{"date":"2026-07-20","count":3},{"date":"2026-07-26","count":1},{"date":"2026-07-27","count":2},{"date":"2026-08-03","count":3},{"date":"2026-08-09","count":1},{"date":"2026-08-10","count":2}],"recent_events":[{"timestamp":"2026-08-10T08:11:03","port":53,"proto":"tcp","app_proto":"","app_protocol":"dns","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u00004�1\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\trr-mirror\bresearch\bnawrocki\u0006berlin\u0000\u0000\u0001\u0000\u0001","payload_hex":"0034e031010000010000000000000972722d6d6972726f72087265736561726368086e6177726f636b69066265726c696e0000010001","method":"","user_agent":"","ja3":"","session":"53ca2454-c696-4e57-ae34-f1cfd172021d","seq":1,"duration_ms":100,"bytes_in":54,"bytes_out":13,"enriched":{"digest":"7ebcf2c0fa196559","strings":["rr-mirror","research","nawrocki","berlin"]}},{"timestamp":"2026-08-10T00:44:55","port":53,"proto":"tcp","app_proto":"","app_protocol":"dns","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u00004�q\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\trr-mirror\bresearch\bnawrocki\u0006berlin\u0000\u0000\u0001\u0000\u0001","payload_hex":"0034ec71010000010000000000000972722d6d6972726f72087265736561726368086e6177726f636b69066265726c696e0000010001","method":"","user_agent":"","ja3":"","session":"4f6bf023-18f3-4897-afdc-065ccd2f709e","seq":1,"duration_ms":100,"bytes_in":54,"bytes_out":13,"enriched":{"digest":"d0e512b86efd1f74","strings":["rr-mirror","research","nawrocki","berlin"]}},{"timestamp":"2026-08-09T23:09:58","port":53,"proto":"tcp","app_proto":"","app_protocol":"dns","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u00004��\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\trr-mirror\bresearch\bnawrocki\u0006berlin\u0000\u0000\u0001\u0000\u0001","payload_hex":"00349eb0010000010000000000000972722d6d6972726f72087265736561726368086e6177726f636b69066265726c696e0000010001","method":"","user_agent":"","ja3":"","session":"f695e597-f281-4b8b-aef0-74885b175624","seq":1,"duration_ms":100,"bytes_in":54,"bytes_out":13,"enriched":{"digest":"e89823bde8c61bae","strings":["rr-mirror","research","nawrocki","berlin"]}},{"timestamp":"2026-08-03T04:28:46","port":53,"proto":"tcp","app_proto":"","app_protocol":"dns","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u00004��\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\trr-mirror\bresearch\bnawrocki\u0006berlin\u0000\u0000\u0001\u0000\u0001","payload_hex":"003497af010000010000000000000972722d6d6972726f72087265736561726368086e6177726f636b69066265726c696e0000010001","method":"","user_agent":"","ja3":"","session":"cb5bcc53-4dbb-49e0-ac6a-c44084b90d30","seq":1,"duration_ms":100,"bytes_in":54,"bytes_out":13,"enriched":{"digest":"e89823bde8c61bae","strings":["rr-mirror","research","nawrocki","berlin"]}},{"timestamp":"2026-08-03T03:57:39","port":53,"proto":"tcp","app_proto":"","app_protocol":"dns","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u00004G�\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\trr-mirror\bresearch\bnawrocki\u0006berlin\u0000\u0000\u0001\u0000\u0001","payload_hex":"003447d6010000010000000000000972722d6d6972726f72087265736561726368086e6177726f636b69066265726c696e0000010001","method":"","user_agent":"","ja3":"","session":"27c14dac-848f-4b34-b064-17aa8f1b4b59","seq":1,"duration_ms":103,"bytes_in":54,"bytes_out":13,"enriched":{"digest":"e281a291a4d5d942","strings":["rr-mirror","research","nawrocki","berlin"]}},{"timestamp":"2026-08-03T01:07:04","port":53,"proto":"tcp","app_proto":"","app_protocol":"dns","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u00004\u0019\u001a\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\trr-mirror\bresearch\bnawrocki\u0006berlin\u0000\u0000\u0001\u0000\u0001","payload_hex":"0034191a010000010000000000000972722d6d6972726f72087265736561726368086e6177726f636b69066265726c696e0000010001","method":"","user_agent":"","ja3":"","session":"27727b84-c0c0-4fcc-be2f-6b377cc2cfee","seq":1,"duration_ms":100,"bytes_in":54,"bytes_out":13,"enriched":{"digest":"bf1518c9d8843cfd","strings":["rr-mirror","research","nawrocki","berlin"]}},{"timestamp":"2026-07-27T08:24:30","port":53,"proto":"tcp","app_proto":"","app_protocol":"dns","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u00004<�\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\trr-mirror\bresearch\bnawrocki\u0006berlin\u0000\u0000\u0001\u0000\u0001","payload_hex":"00343cce010000010000000000000972722d6d6972726f72087265736561726368086e6177726f636b69066265726c696e0000010001","method":"","user_agent":"","ja3":"","session":"511835bd-5574-4c65-be6a-9c60249a6284","seq":1,"duration_ms":100,"bytes_in":54,"bytes_out":13,"enriched":{"digest":"1b824ef54788379a","strings":["rr-mirror","research","nawrocki","berlin"]}},{"timestamp":"2026-07-27T07:58:17","port":53,"proto":"tcp","app_proto":"","app_protocol":"dns","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u00004�,\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\trr-mirror\bresearch\bnawrocki\u0006berlin\u0000\u0000\u0001\u0000\u0001","payload_hex":"0034ba2c010000010000000000000972722d6d6972726f72087265736561726368086e6177726f636b69066265726c696e0000010001","method":"","user_agent":"","ja3":"","session":"347404b9-6cdb-40ec-a626-b062c98ba59a","seq":1,"duration_ms":100,"bytes_in":54,"bytes_out":13,"enriched":{"digest":"1dafd02bf949a921","strings":["rr-mirror","research","nawrocki","berlin"]}},{"timestamp":"2026-07-26T23:34:38","port":53,"proto":"tcp","app_proto":"","app_protocol":"dns","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u000046�\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\trr-mirror\bresearch\bnawrocki\u0006berlin\u0000\u0000\u0001\u0000\u0001","payload_hex":"003436dd010000010000000000000972722d6d6972726f72087265736561726368086e6177726f636b69066265726c696e0000010001","method":"","user_agent":"","ja3":"","session":"abf4ed3f-3d07-44c1-b414-98727e48e257","seq":1,"duration_ms":100,"bytes_in":54,"bytes_out":13,"enriched":{"digest":"c36f2448c0b29ed4","strings":["rr-mirror","research","nawrocki","berlin"]}},{"timestamp":"2026-07-20T06:23:55","port":53,"proto":"tcp","app_proto":"","app_protocol":"dns","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u00004��\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\trr-mirror\bresearch\bnawrocki\u0006berlin\u0000\u0000\u0001\u0000\u0001","payload_hex":"00349bc7010000010000000000000972722d6d6972726f72087265736561726368086e6177726f636b69066265726c696e0000010001","method":"","user_agent":"","ja3":"","session":"701d2c4d-8f23-4c1c-8f97-acf143bc29fd","seq":1,"duration_ms":100,"bytes_in":54,"bytes_out":13,"enriched":{"digest":"e89823bde8c61bae","strings":["rr-mirror","research","nawrocki","berlin"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-14T17:51:23.082755+00:00"}