{"ip":"185.247.137.162","total_events":72,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"driftnet","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (driftnet).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"touch","label":"Touch only","detail":"44 bytes sent, no real exchange","bytes_sent":44,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-18T12:32:17","last_seen":"2026-08-23T00:48:32","events_24h":0,"events_7d":0,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"England","city":"Manchester","lat":51.5081,"lon":-0.1278,"asn":211298,"org":"Driftnet Ltd"},"source_domain":"r4-162-a2.monitoring.internet-measurement.com","known_scanners":["driftnet","Internet-Measurement"],"scanner_tag":{"key":"internet-measurement","label":"Internet-Measurement","category":"research","url":"https://internet-measurement.com/"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"quic","events":1}],"ports":[{"port":8443,"events":1}],"dns_questions":[],"quic_clients":[{"ja4":"q13i0307h9_55b375c5d22e_39d5f8cd0d4d","transport_params_hash":"60647680e335","server_name":"","events":1}],"first_seen":"2026-10-06T09:55:40","last_seen":"2026-10-06T09:55:40","recent":[{"timestamp":"2026-10-06T09:55:40","port":8443,"src_port":12975,"proto":"udp","app_proto":"quic","app_protocol":"quic","summary":"QUIC v1 Initial alpn=http/0.9,http/1.0,spdy/1,spdy/2,spdy/3,stun.turn,stun.nat-discovery,h2c,webrtc,c-webrtc,ftp,imap,pop3,managesieve,coap,co","payload_hex":"","sni":"","session":"44492f88-3f79-43db-9d64-eba08797a505","bytes_in":1200,"source_verified":false,"quic":{"version":"1","ja4":"q13i0307h9_55b375c5d22e_39d5f8cd0d4d","transport_params_hash":"60647680e335","version_negotiation":false}}]},"top_ports":[{"port":22,"proto":"tcp","label":"SSH","count":12},{"port":3389,"proto":"tcp","label":"RDP","count":10},{"port":3306,"proto":"tcp","label":"MySQL","count":10},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":5},{"port":1522,"proto":"tcp","label":"","count":4},{"port":5601,"proto":"tcp","label":"Kibana","count":3},{"port":7023,"proto":"tcp","label":"","count":3},{"port":50897,"proto":"tcp","label":"","count":3},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":3},{"port":42215,"proto":"tcp","label":"","count":3},{"port":9933,"proto":"tcp","label":"","count":2},{"port":41794,"proto":"tcp","label":"","count":2},{"port":6891,"proto":"tcp","label":"","count":1},{"port":47001,"proto":"tcp","label":"","count":1},{"port":111,"proto":"tcp","label":"RPC","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i300900_3c43a67630b3_e7c285222651"],"tls_client_hello":"","tls_ja3":[],"http_akin":["b10cun000_00000000_334359b9","b11cun050_00040017_6b90553b"]},"fingerprint_peers":{"t13i300900_3c43a67630b3_e7c285222651":204,"b10cun000_00000000_334359b9":2342,"b11cun050_00040017_6b90553b":1335},"akin_families":{"b11cun050_00040017_6b90553b":{"head":"b11cun050_00040017_6b90553b","shapes":10,"ips":1334}},"user_agents":["Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)"],"timeline":[{"date":"2026-08-23","count":1}],"recent_events":[{"timestamp":"2026-08-23T00:48:32","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=eltons\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d656c746f6e730d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"4ef60e20-d05a-448b-901d-8696c4835cf3","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":15,"enriched":{"digest":"9920618c983235b0","label":"RDP (X.224)","strings":["Cookie: mstshash=eltons"]}},{"timestamp":"2026-05-06T22:43:26","port":3306,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3306\",\"user-agent\":\"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333330360d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e7465726e65744d6561737572656d656e742f312e303b202b68747470733a2f2f696e7465726e65742d6d6561737572656d656e742e636f6d2f290d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)","ja3":"","session":"f2533fd0-0cda-4a6b-8e48-8f5f08dc8884","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-04-30T20:30:51","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e7465726e65744d6561737572656d656e742f312e303b202b68747470733a2f2f696e7465726e65742d6d6561737572656d656e742e636f6d2f290d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)","ja3":"","session":"6b259a12-9368-416b-b61b-ed5248b0ad8f","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-04-30T04:55:30","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ONNECT\naccept-version:1.0,1.1,2.0\n\n\u0000","payload_hex":"434f4e4e4543540a6163636570742d76657273696f6e3a312e302c312e312c322e300a0a00","method":"","user_agent":"","ja3":"","session":"39319849-bed0-48ee-899d-201e5847cf53","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c12ecebdbd4a651a","strings":["ONNECT","accept-version:1.0,1.1,2.0"]}},{"timestamp":"2026-04-29T01:55:27","port":22,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:22\",\"user-agent\":\"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32320d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e7465726e65744d6561737572656d656e742f312e303b202b68747470733a2f2f696e7465726e65742d6d6561737572656d656e742e636f6d2f290d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)","ja3":"","session":"ca2551e1-5023-42b9-aec1-04ac500cba92","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-04-29T01:54:17","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���version\u0000\u0000\u0000\u0000\u0000V\u0000\u0000\u0000�\u001e\u0002��\u0011\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�d�i\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000\u0001 �\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000\u0001 �\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"f9beb4d976657273696f6e000000000056000000d91e02a0801101000000000000000000c764f16900000000000000000000000000000000000000000000ffff7f000001208d000000000000000000000000000000000000ffff7f000001208d0000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"2fa5329f-55f8-44d8-be07-490eb32f17e5","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"586cff1c03c30701","strings":["version","versionV"]}},{"timestamp":"2026-04-29T01:54:15","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����̎0au��\b}V�\f`�gH�\u0011Ҥ�ASh\u0004\u0003�;���(r\u0002�r�Z�א�?�1��X\u0012\u001a�\u0000�\u001e\u001a��\u0010X���ڊ��ָ������\u0002��bwG\u001dH\"��o}t�af\u0016�\u0005���b}Ӯ&\u0015Q��=��4 ���zuڥ���\u0002E��+u\u0019�I5T�)�,2�����0���r��e/��\u001avң\u001eߚ�E\u0003L��\u0015\u0015[�0\\\\�\u001f�%{��\u0011�\u00167n x���8P��hw��7O�����&\u001c�ˮ��Q(����yge�o.�j\tD�Ϲ��\u000b��*\u0007����\u0002)TJ�~6\nV�>&p�\u001f�Mq\u0011^���6t1��_⥄c\u0014��9�X���\u000b��\u0018�Z�\u0014��Zӓj��CDz\u0016�\u0015�d�*���c","payload_hex":"c680f4e0f8cc8e306175c3e3087d56b10c60d16748d411d2a4a44153680403993beecfcc287202fd72f05aa7d790863fdf318abe58121af000ad1e1ab5df1058f5e6b0da8a969cd6b897bbe6f480a502c9e56277471d4822fbbb6f7d7491616616ed05bbc1da627dd3ae261551e3d33d8f9134209b92837a75daa580a7d20245afae2b7519b7493554be298b2c32aa9ab3becb3096819372bb80652f89ee1a76d2a31edf9afd45034cf7c515155ba2305c5ca31fd0257bfaeb11f816376e2078eb9bf83850caea6877a4b0374f83c0e6d0fe267f1c82cbaec5e4512887b2aad17967658e6f2efa6a0944fbcfb9ebb40bf5e42a0795a199f50229544ac47e360a56ae3e26709e1ff04d71115ef1eedf3674319ae05fe2a584631482f939f5589fd9e40bf9bc18aa5aa2148bd45ad3936a80ce43447a16da15ea64972a91d5ea63","method":"","user_agent":"","ja3":"","session":"994c011f-4702-42d4-bc79-7aa1e22c5ba9","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"da230c63a979d514","strings":["7n x"]}},{"timestamp":"2026-04-23T05:38:14","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���version\u0000\u0000\u0000\u0000\u0000V\u0000\u0000\u0000EY�\u0018�\u0011\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000C��i\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000\u0001 �\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000\u0001 �\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"f9beb4d976657273696f6e0000000000560000004559e01880110100000000000000000043b0e96900000000000000000000000000000000000000000000ffff7f000001208d000000000000000000000000000000000000ffff7f000001208d0000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"6558405a-5d97-4382-b36c-4c4826c71a67","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"f636f36f8f117a70","strings":["version","versionVEY"]}},{"timestamp":"2026-04-23T05:38:11","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�1C3�\n%\u000b\u001bQ�w���^,Jߘ.���C��v�S�cCV���;��t��������(���)i�)�\u001dL�\u0000a����,+\t}ME��㱄�K���1�\f�=�0���\n�}��i;�\u0004�\u0010c\u001bN�f�Ǘ\b���X�a\u0007\u0017r��\u001f���j�\bgmY�>y;��\u000049����Ab\u0017��p�DJ��\u0007�\u000e�dYG�\u0015gB�i�����8z����~0\u0005��Ĵ��Ws�5ϒ�&邏��0\u0018x�I�����[�j\u0018II�a�Z�\u000e�wx4�\u0005,,r��\u0018u��f���\u0003\u0007j\u0011ww�$F^<�J�u�h~Y�\u0006�5�L*�q�&�X�]�������Z�L�DG-ն\u0017\u0013\u0010�aFm��\u0006x֎���'�X_�;","payload_hex":"8bfc314333d30a250b1b518477b9bfba5e2c4adf982eafe4b243be8b76b053e4634356a5f18a3bec8d74e6a3fcf1a8f5f5ae28b09fc02969f029be1d4ce20061ec92e8892c2b097d4d45f096e3b184f34bfe9fa031b30cb93dd230ab96c70a817df9a4693bb9049f10631b4eba66fdc79708c1eddf58e56107177291fe1f84acfc6ad408676d59b23e793b98870034398bffbbf0416217fbd370a9444aff9407e80eeb6459478d156742bc69f1cdf6858a7f387a90d0ed8a7e3005c2e1c4b4b3ba5773d335cf92bb26e9828f8adc301878f14991b297eaba5bc26a1849499c61965ab70ee377783481052c2c728edc1875af7fa166b8b8da03076a1177779024465e3c964ac275fb687e59d2069935a64c2aff719326d358935db1a8cef9eadcdc5af04cb744472dd5b6171310b661466da2c50678d68ec8fbba27d8585fef3b","method":"","user_agent":"","ja3":"","session":"a49d6c82-f997-4816-b97e-95a81ffd15e9","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d2c8e1348d43cd56","strings":["$F^<"]}},{"timestamp":"2026-04-23T05:35:09","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000�\u0000","payload_hex":"300c020101600702010304008000","method":"","user_agent":"","ja3":"","session":"ff09edfa-185b-4f64-b21f-6de511e84744","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0}],"http_methods":[{"method":"GET","count":6}],"distinct_ports_total":24,"top_paths":[{"path":"/","count":6,"ports":5}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:3306","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[],"data_as_of":"2026-10-12T12:56:38.916658+00:00"}