{"ip":"185.247.137.52","total_events":55,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"driftnet","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (driftnet).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"780 bytes sent","bytes_sent":780,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-18T12:55:36","last_seen":"2026-09-26T15:30:32","events_24h":0,"events_7d":0,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"England","city":"Manchester","lat":51.5081,"lon":-0.1278,"asn":211298,"org":"Driftnet Ltd"},"source_domain":"r4-52-34.monitoring.internet-measurement.com","known_scanners":["driftnet","Internet-Measurement"],"scanner_tag":{"key":"internet-measurement","label":"Internet-Measurement","category":"research","url":"https://internet-measurement.com/"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"quic","events":1}],"ports":[{"port":8443,"events":1}],"dns_questions":[],"quic_clients":[{"ja4":"q13i0310h3_55b375c5d22e_3db21c8b774f","transport_params_hash":"1f7a23748abd","server_name":"","events":1}],"first_seen":"2026-10-06T08:19:00","last_seen":"2026-10-06T08:19:00","recent":[{"timestamp":"2026-10-06T08:19:00","port":8443,"src_port":13319,"proto":"udp","app_proto":"quic","app_protocol":"quic","summary":"QUIC v1 Initial alpn=h3,h3-29","payload_hex":"","sni":"","session":"fa0db17c-469a-4e54-8be9-85a1513a8449","bytes_in":1200,"source_verified":false,"quic":{"version":"1","ja4":"q13i0310h3_55b375c5d22e_3db21c8b774f","transport_params_hash":"1f7a23748abd","version_negotiation":false}}]},"top_ports":[{"port":3306,"proto":"tcp","label":"MySQL","count":12},{"port":22222,"proto":"tcp","label":"","count":6},{"port":22,"proto":"tcp","label":"SSH","count":5},{"port":3389,"proto":"tcp","label":"RDP","count":5},{"port":8585,"proto":"tcp","label":"","count":3},{"port":8521,"proto":"tcp","label":"","count":3},{"port":544,"proto":"tcp","label":"","count":2},{"port":80,"proto":"tcp","label":"HTTP","count":2},{"port":20281,"proto":"tcp","label":"","count":2},{"port":9503,"proto":"tcp","label":"","count":2},{"port":771,"proto":"tcp","label":"","count":1},{"port":7250,"proto":"tcp","label":"","count":1},{"port":9200,"proto":"tcp","label":"Elastic","count":1},{"port":20219,"proto":"tcp","label":"","count":1},{"port":21,"proto":"tcp","label":"FTP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i300900_3c43a67630b3_e7c285222651"],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun050_00040017_6b90553b"]},"fingerprint_peers":{"t13i300900_3c43a67630b3_e7c285222651":203,"b11cun050_00040017_6b90553b":1341},"akin_families":{"b11cun050_00040017_6b90553b":{"head":"b11cun050_00040017_6b90553b","shapes":10,"ips":1341}},"user_agents":["Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)"],"timeline":[{"date":"2026-08-28","count":1},{"date":"2026-08-29","count":1},{"date":"2026-09-21","count":1},{"date":"2026-09-26","count":1}],"recent_events":[{"timestamp":"2026-09-26T15:30:32","port":8008,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8008\",\"user-agent\":\"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030380d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e7465726e65744d6561737572656d656e742f312e303b202b68747470733a2f2f696e7465726e65742d6d6561737572656d656e742e636f6d2f290d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)","ja3":"","session":"41a6e5f4-346b-4b7d-b4aa-1b50c60f855b","seq":1,"duration_ms":100,"bytes_in":198,"bytes_out":79},{"timestamp":"2026-09-21T17:41:02","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e7465726e65744d6561737572656d656e742f312e303b202b68747470733a2f2f696e7465726e65742d6d6561737572656d656e742e636f6d2f290d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)","ja3":"","session":"9f1c2417-7997-4130-805c-1858c851d129","seq":1,"duration_ms":100,"bytes_in":194,"bytes_out":79},{"timestamp":"2026-08-29T18:01:06","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e7465726e65744d6561737572656d656e742f312e303b202b68747470733a2f2f696e7465726e65742d6d6561737572656d656e742e636f6d2f290d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)","ja3":"","session":"da9fb7f9-e131-4d1e-8ff9-04df5ef40540","seq":1,"duration_ms":100,"bytes_in":192,"bytes_out":79},{"timestamp":"2026-08-28T05:51:20","port":21,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:21\",\"user-agent\":\"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e7465726e65744d6561737572656d656e742f312e303b202b68747470733a2f2f696e7465726e65742d6d6561737572656d656e742e636f6d2f290d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)","ja3":"","session":"c69a4a57-383e-48bd-87ab-409dde27c98f","seq":1,"duration_ms":20,"bytes_in":196,"bytes_out":34},{"timestamp":"2026-05-03T10:54:16","port":3306,"proto":"tcp","app_proto":"","app_protocol":"mysql","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ET / HTTP/1.1\r\nHost: <HONEYPOT>:3306\r\nUser-Agent: Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)\r\nConnection: close\r\nAccept: */*\r\nAccept-Encoding: gzip\r\n\r\n","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333330360d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e7465726e65744d6561737572656d656e742f312e303b202b68747470733a2f2f696e7465726e65742d6d6561737572656d656e742e636f6d2f290d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"","user_agent":"","ja3":"","session":"3a928f49-421c-4224-aa9e-a9d98afecf70","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c264c54236f86b6b","strings":["ET / HTTP/1.1","Host: <HONEYPOT>:3306","User-Agent: Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-…","Connection: close","Accept: */*","Accept-Encoding: gzip"],"iocs":{"urls":["https://internet-…"]}}},{"timestamp":"2026-04-29T08:57:45","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���version\u0000\u0000\u0000\u0000\u0000V\u0000\u0000\u0000ڎ#\u0014�\u0011\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0007��i\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000\u0001 �\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000\u0001 �\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"f9beb4d976657273696f6e000000000056000000da8e231480110100000000000000000007c8f16900000000000000000000000000000000000000000000ffff7f000001208d000000000000000000000000000000000000ffff7f000001208d0000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"825b94d0-e4ba-4142-bfbf-a1e11b37047d","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"424d7b27fd4df74b","strings":["version","versionV"]}},{"timestamp":"2026-04-29T08:57:43","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0016|�83�F�����c\u0013�t�&\u000eX��K�Yn\u001c���\u0006\u0014���q��텎`\u0012]�\r\u0013^���_�U\n�g3v/s�a\f�m�\u0004\u0018�\u0015F�\u000eT�\u001b��\u0003��ty�]����<ٻDH�EZ��z)0���J�+'��;^����4�׀�e�\fN��\u0013��?4�9\u0017�z؞�4îH�\u0018ڳ�\u0007\u0016����\u0012l=\u00140���J]�&+]\\m�\n\u0010�o���\u0005^�� Z8�ZP�\u0018__\"h'\u0012È1\u001c������\bȞ@�Y�������������|�r����{\u0012!S��Q�yS=c��\u001dH4 \u000f�뱬\u001fF����$l��9�\u0007|�cȂ\u001d\u000e ��2aG�>�Yl�V\b����⯋J\u0001\u001c�Yt�9R͟\u0005\u0016~","payload_hex":"edb6167cb03833c446c0ae8fe6d16313d67489260e58e4894bcf596e1c8299ec0614e3c0ac71a1eced858e60125de90d135e96f2f45f9d557f0aed6733762f73ff610cbe6d890418ff1546d10e54c61bfe9003fdc87479b15de3c9f9bb3cd9bb4448b5455ac6df7a29308d9ef04ae22b27adef3b5e9097b4cb349dd780ee658b0c4eced213e5e63f34847f3917d47ad89eff34c3ae48eb18dab3a207169ea482a5126c3d143082af894a5dc4262b5d5c6dc70a10c46fd4e4e6055ebef0205a38b55a508d185f5f22682712c388311cacae84f8bfb808c89e40f259bb8b96e2c1aab68a93b6eecae97c9672878be1e57b12215381ee51f179533d63f5f51d4834200ffeebb1ac1f46c4cceaf6246c8eb739a8077c8863c8827f1d0e20dbf9326147a73ee9596cb65608a87ffaf9ade2af8b4a011c9e597f74bb3952cd9f05167e","method":"","user_agent":"","ja3":"","session":"938e85c8-9888-4945-908e-951373a67996","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"0426b6fdafe2d8fe","strings":["g3v/s","&+]\\m","__\"h'","yS=c"]}},{"timestamp":"2026-04-20T12:22:24","port":3306,"proto":"tcp","app_proto":"","app_protocol":"iscsi","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000\u0000\u0000\u0000�\u0000\u0002=\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000SessionType=Discovery\u0000MaxRecvDataSegmentLength=32768\u0000InitiatorName=iqn.2003-01.com.linux-iscsi:9673562707\u0000HeaderDigest=None\u0000DataDigest=None\u0000","payload_hex":"438700000000008c00023d0000000000000000000000000000000001000000000000000000000000000000000000000053657373696f6e547970653d446973636f76657279004d617852656376446174615365676d656e744c656e6774683d333237363800496e69746961746f724e616d653d69716e2e323030332d30312e636f6d2e6c696e75782d69736373693a39363733353632373037004865616465724469676573743d4e6f6e6500446174614469676573743d4e6f6e6500","method":"","user_agent":"","ja3":"","session":"99e685dc-cd4f-4c2d-9555-1b5102ac1dad","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a2351a5893246110","label":"iSCSI","strings":["SessionType=Discovery","MaxRecvDataSegmentLength=32768","InitiatorName=iqn.2003-01.com.linux-iscsi:9673562707","HeaderDigest=None","DataDigest=None","SessionType=DiscoveryMaxRecvDataSegmentLength=32768InitiatorName=iqn.2003-01.com…"],"iocs":{"domains":["iqn.2003-01.com.linux","iqn.2003-01.com"]}}},{"timestamp":"2026-04-18T21:57:35","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ELFD\u0000\u0000\u0000\u0000\u0000\u0000\u0000������\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0000\u0000opc.tcp://localhost:4840/UADiscovery","payload_hex":"48454c464400000000000000ffffff7fffffff7f0000000000000000240000006f70632e7463703a2f2f6c6f63616c686f73743a343834302f5541446973636f76657279","method":"","user_agent":"","ja3":"","session":"007ea1ad-81d2-40ef-a93b-72af2376cf7e","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a95d9567a4a36030","strings":["ELFD","opc.tcp://localhost:4840/UADiscovery","$opc.tcp://localhost:4840/UADiscovery"],"iocs":{"domains":["opc.tcp"]}}},{"timestamp":"2026-04-18T21:54:22","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"</stream:stream>","payload_hex":"3c2f73747265616d3a73747265616d3e","method":"","user_agent":"","ja3":"","session":"71c01a2c-f358-4d13-8dff-a97360ee8292","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"b68e3b0eb6d9d394","strings":["</stream:stream>"]}}],"http_methods":[{"method":"GET","count":9}],"distinct_ports_total":23,"top_paths":[{"path":"/","count":9,"ports":8}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8008","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[],"data_as_of":"2026-10-12T09:20:46.655744+00:00"}