{"ip":"171.67.71.223","total_events":354,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"universities","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (universities).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"75,957 bytes sent","bytes_sent":75957,"session_seconds":0,"persistent":false}},"first_seen":"2026-05-07T17:18:55","last_seen":"2026-08-14T20:26:43","events_24h":38,"events_7d":254,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Palo Alto","lat":37.4333,"lon":-122.1878,"asn":32,"org":"Stanford University"},"source_domain":"research.esrg.stanford.edu","known_scanners":["universities"],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":64},{"port":80,"proto":"tcp","label":"HTTP","count":64},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":15},{"port":5224,"proto":"tcp","label":"","count":9},{"port":8081,"proto":"tcp","label":"","count":8},{"port":14000,"proto":"tcp","label":"","count":8},{"port":3004,"proto":"tcp","label":"","count":8},{"port":5225,"proto":"tcp","label":"","count":7},{"port":7003,"proto":"tcp","label":"","count":6},{"port":3000,"proto":"tcp","label":"Web-alt","count":6},{"port":8002,"proto":"tcp","label":"","count":5},{"port":7006,"proto":"tcp","label":"","count":5},{"port":30014,"proto":"tcp","label":"","count":5},{"port":9090,"proto":"tcp","label":"Prometheus","count":5},{"port":7004,"proto":"tcp","label":"","count":5}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-05-18","count":1},{"date":"2026-05-27","count":17},{"date":"2026-08-06","count":48},{"date":"2026-08-07","count":34},{"date":"2026-08-08","count":48},{"date":"2026-08-09","count":52},{"date":"2026-08-10","count":50},{"date":"2026-08-11","count":19},{"date":"2026-08-12","count":8},{"date":"2026-08-13","count":32},{"date":"2026-08-14","count":38}],"recent_events":[{"timestamp":"2026-08-14T20:26:43","port":5225,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"s�h�?\u0007\u0004\u0001 69d747c4b9f641baf4004be4297e9f3b\u001b\u0014\"��\u0007Q`-\t\u0015�4��$������\u0000\u0000\u0000\u0002i�*B\u0000�`\u0000\u00152apxR62nUN71c2MDOc9zo\u0000`z�N�:�3Fv��pȡ����DSM4����\r\u0018�5�*�;hܫ{�\u0006H��w,�\n<�b��\u0010��VsF�cϡr}=~\u0014_�[\t\n����uܠ��\f�<ʜ��'��{��5;\u0010Bp{�o%���Ho����U","payload_hex":"73ea68fb3f0704012036396437343763346239663634316261663430303462653432393765396633621b1422ede00751602d0915a734a08924a6a1fcb393c30000000269ad2a42008a600015326170785236326e554e373163324d444f63397a6f00607af54ee43afa334676ae9870c8a1fd809bc444534d34e9d2f9840d18dc35f82a8e3b68dcab7bb4064894a3772cb20a3ca862e6a510adc0567346c163cfa1727d3d7e145fd95b090abbc7cce575dca08ca40cb23cca9cb0b427aa9b7ba0d1353b1042707baa6f25e9a1f9486f92fcecb755","method":"","user_agent":"","ja3":"","session":"90eddde8-254c-4741-9bec-23df2bb754d1","seq":1,"duration_ms":100,"bytes_in":212,"bytes_out":13,"enriched":{"digest":"3ce1a0c9d351c7cc","strings":["69d747c4b9f641baf4004be4297e9f3b","2apxR62nUN71c2MDOc9zo","DSM4","r}=~","2apxR62nUN71c2MDOc9zo`z"]}},{"timestamp":"2026-08-14T20:22:41","port":5225,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"s�h�?\u0007\u0004\u0001 69d747c4b9f641baf4004be4297e9f3b\u001b\u0014\"��\u0007Q`-\t\u0015�4��$������\u0000\u0000\u0000\u0002i�*B\u0000�`\u0000\u00152apxR62nUN71c2MDOc9zo\u0000`z�N�:�3Fv��pȡ����DSM4����\r\u0018�5�*�;hܫ{�\u0006H��w,�\n<�b��\u0010��VsF�cϡr}=~\u0014_�[\t\n����uܠ��\f�<ʜ��'��{��5;\u0010Bp{�o%���Ho����U","payload_hex":"73ea68fb3f0704012036396437343763346239663634316261663430303462653432393765396633621b1422ede00751602d0915a734a08924a6a1fcb393c30000000269ad2a42008a600015326170785236326e554e373163324d444f63397a6f00607af54ee43afa334676ae9870c8a1fd809bc444534d34e9d2f9840d18dc35f82a8e3b68dcab7bb4064894a3772cb20a3ca862e6a510adc0567346c163cfa1727d3d7e145fd95b090abbc7cce575dca08ca40cb23cca9cb0b427aa9b7ba0d1353b1042707baa6f25e9a1f9486f92fcecb755","method":"","user_agent":"","ja3":"","session":"5274e54a-4ba4-4fa3-b34e-3dcca3a86425","seq":1,"duration_ms":101,"bytes_in":212,"bytes_out":13,"enriched":{"digest":"3ce1a0c9d351c7cc","strings":["69d747c4b9f641baf4004be4297e9f3b","2apxR62nUN71c2MDOc9zo","DSM4","r}=~","2apxR62nUN71c2MDOc9zo`z"]}},{"timestamp":"2026-08-14T19:18:17","port":5225,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"s�h�?\u0007\u0004\u0001 69d747c4b9f641baf4004be4297e9f3b\u001b\u0014\"��\u0007Q`-\t\u0015�4��$������\u0000\u0000\u0000\u0002i�*B\u0000�`\u0000\u00152apxR62nUN71c2MDOc9zo\u0000`z�N�:�3Fv��pȡ����DSM4����\r\u0018�5�*�;hܫ{�\u0006H��w,�\n<�b��\u0010��VsF�cϡr}=~\u0014_�[\t\n����uܠ��\f�<ʜ��'��{��5;\u0010Bp{�o%���Ho����U","payload_hex":"73ea68fb3f0704012036396437343763346239663634316261663430303462653432393765396633621b1422ede00751602d0915a734a08924a6a1fcb393c30000000269ad2a42008a600015326170785236326e554e373163324d444f63397a6f00607af54ee43afa334676ae9870c8a1fd809bc444534d34e9d2f9840d18dc35f82a8e3b68dcab7bb4064894a3772cb20a3ca862e6a510adc0567346c163cfa1727d3d7e145fd95b090abbc7cce575dca08ca40cb23cca9cb0b427aa9b7ba0d1353b1042707baa6f25e9a1f9486f92fcecb755","method":"","user_agent":"","ja3":"","session":"c8926e37-2e68-4d42-bbf9-3827f267803c","seq":1,"duration_ms":100,"bytes_in":212,"bytes_out":13,"enriched":{"digest":"3ce1a0c9d351c7cc","strings":["69d747c4b9f641baf4004be4297e9f3b","2apxR62nUN71c2MDOc9zo","DSM4","r}=~","2apxR62nUN71c2MDOc9zo`z"]}},{"timestamp":"2026-08-14T18:54:21","port":5224,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"s�h�?\u0007\u0004\u0001 69d747c4b9f641baf4004be4297e9f3b\u001b\u0014\"��\u0007Q`-\t\u0015�4��$������\u0000\u0000\u0000\u0002i�*B\u0000�`\u0000\u00152apxR62nUN71c2MDOc9zo\u0000`z�N�:�3Fv��pȡ����DSM4����\r\u0018�5�*�;hܫ{�\u0006H��w,�\n<�b��\u0010��VsF�cϡr}=~\u0014_�[\t\n����uܠ��\f�<ʜ��'��{��5;\u0010Bp{�o%���Ho����U","payload_hex":"73ea68fb3f0704012036396437343763346239663634316261663430303462653432393765396633621b1422ede00751602d0915a734a08924a6a1fcb393c30000000269ad2a42008a600015326170785236326e554e373163324d444f63397a6f00607af54ee43afa334676ae9870c8a1fd809bc444534d34e9d2f9840d18dc35f82a8e3b68dcab7bb4064894a3772cb20a3ca862e6a510adc0567346c163cfa1727d3d7e145fd95b090abbc7cce575dca08ca40cb23cca9cb0b427aa9b7ba0d1353b1042707baa6f25e9a1f9486f92fcecb755","method":"","user_agent":"","ja3":"","session":"1e31e6a1-59d0-4df8-95a1-47d4e7502f22","seq":1,"duration_ms":100,"bytes_in":212,"bytes_out":13,"enriched":{"digest":"3ce1a0c9d351c7cc","strings":["69d747c4b9f641baf4004be4297e9f3b","2apxR62nUN71c2MDOc9zo","DSM4","r}=~","2apxR62nUN71c2MDOc9zo`z"]}},{"timestamp":"2026-08-14T18:44:46","port":5224,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"s�h�?\u0007\u0004\u0001 69d747c4b9f641baf4004be4297e9f3b\u001b\u0014\"��\u0007Q`-\t\u0015�4��$������\u0000\u0000\u0000\u0002i�*B\u0000�`\u0000\u00152apxR62nUN71c2MDOc9zo\u0000`z�N�:�3Fv��pȡ����DSM4����\r\u0018�5�*�;hܫ{�\u0006H��w,�\n<�b��\u0010��VsF�cϡr}=~\u0014_�[\t\n����uܠ��\f�<ʜ��'��{��5;\u0010Bp{�o%���Ho����U","payload_hex":"73ea68fb3f0704012036396437343763346239663634316261663430303462653432393765396633621b1422ede00751602d0915a734a08924a6a1fcb393c30000000269ad2a42008a600015326170785236326e554e373163324d444f63397a6f00607af54ee43afa334676ae9870c8a1fd809bc444534d34e9d2f9840d18dc35f82a8e3b68dcab7bb4064894a3772cb20a3ca862e6a510adc0567346c163cfa1727d3d7e145fd95b090abbc7cce575dca08ca40cb23cca9cb0b427aa9b7ba0d1353b1042707baa6f25e9a1f9486f92fcecb755","method":"","user_agent":"","ja3":"","session":"c16c324d-268a-456a-ae53-bd60d509b1e3","seq":1,"duration_ms":100,"bytes_in":212,"bytes_out":13,"enriched":{"digest":"3ce1a0c9d351c7cc","strings":["69d747c4b9f641baf4004be4297e9f3b","2apxR62nUN71c2MDOc9zo","DSM4","r}=~","2apxR62nUN71c2MDOc9zo`z"]}},{"timestamp":"2026-08-14T17:47:38","port":5224,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"s�h�?\u0007\u0004\u0001 69d747c4b9f641baf4004be4297e9f3b\u001b\u0014\"��\u0007Q`-\t\u0015�4��$������\u0000\u0000\u0000\u0002i�*B\u0000�`\u0000\u00152apxR62nUN71c2MDOc9zo\u0000`z�N�:�3Fv��pȡ����DSM4����\r\u0018�5�*�;hܫ{�\u0006H��w,�\n<�b��\u0010��VsF�cϡr}=~\u0014_�[\t\n����uܠ��\f�<ʜ��'��{��5;\u0010Bp{�o%���Ho����U","payload_hex":"73ea68fb3f0704012036396437343763346239663634316261663430303462653432393765396633621b1422ede00751602d0915a734a08924a6a1fcb393c30000000269ad2a42008a600015326170785236326e554e373163324d444f63397a6f00607af54ee43afa334676ae9870c8a1fd809bc444534d34e9d2f9840d18dc35f82a8e3b68dcab7bb4064894a3772cb20a3ca862e6a510adc0567346c163cfa1727d3d7e145fd95b090abbc7cce575dca08ca40cb23cca9cb0b427aa9b7ba0d1353b1042707baa6f25e9a1f9486f92fcecb755","method":"","user_agent":"","ja3":"","session":"b6615746-6c2a-4363-8029-01af1e1f499e","seq":1,"duration_ms":100,"bytes_in":212,"bytes_out":13,"enriched":{"digest":"3ce1a0c9d351c7cc","strings":["69d747c4b9f641baf4004be4297e9f3b","2apxR62nUN71c2MDOc9zo","DSM4","r}=~","2apxR62nUN71c2MDOc9zo`z"]}},{"timestamp":"2026-08-14T17:19:47","port":5224,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"s�h�?\u0007\u0004\u0001 69d747c4b9f641baf4004be4297e9f3b\u001b\u0014\"��\u0007Q`-\t\u0015�4��$������\u0000\u0000\u0000\u0002i�*B\u0000�`\u0000\u00152apxR62nUN71c2MDOc9zo\u0000`z�N�:�3Fv��pȡ����DSM4����\r\u0018�5�*�;hܫ{�\u0006H��w,�\n<�b��\u0010��VsF�cϡr}=~\u0014_�[\t\n����uܠ��\f�<ʜ��'��{��5;\u0010Bp{�o%���Ho����U","payload_hex":"73ea68fb3f0704012036396437343763346239663634316261663430303462653432393765396633621b1422ede00751602d0915a734a08924a6a1fcb393c30000000269ad2a42008a600015326170785236326e554e373163324d444f63397a6f00607af54ee43afa334676ae9870c8a1fd809bc444534d34e9d2f9840d18dc35f82a8e3b68dcab7bb4064894a3772cb20a3ca862e6a510adc0567346c163cfa1727d3d7e145fd95b090abbc7cce575dca08ca40cb23cca9cb0b427aa9b7ba0d1353b1042707baa6f25e9a1f9486f92fcecb755","method":"","user_agent":"","ja3":"","session":"959a06ec-ed11-4264-90ea-1cb057f8ed1c","seq":1,"duration_ms":100,"bytes_in":212,"bytes_out":13,"enriched":{"digest":"3ce1a0c9d351c7cc","strings":["69d747c4b9f641baf4004be4297e9f3b","2apxR62nUN71c2MDOc9zo","DSM4","r}=~","2apxR62nUN71c2MDOc9zo`z"]}},{"timestamp":"2026-08-14T16:39:26","port":3004,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��[MZZZZZx`2\u0000\u0000*�ZZZZZZZ[\u0000\u0000\u00184y\u0000=�u\u001c�\u0015\u0007UӤ�:�zQ�W=�\f\u000b�\b�D;��eEY�