{"ip":"185.247.137.62","total_events":64,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"driftnet","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (driftnet).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"2,371 bytes sent","bytes_sent":2371,"session_seconds":16,"persistent":false}},"first_seen":"2026-02-19T23:28:14","last_seen":"2026-09-26T15:43:33","events_24h":0,"events_7d":10,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"England","city":"Manchester","lat":51.5081,"lon":-0.1278,"asn":211298,"org":"Driftnet Ltd"},"source_domain":"r4-62-3e.monitoring.internet-measurement.com","known_scanners":["driftnet","Internet-Measurement"],"scanner_tag":{"key":"internet-measurement","label":"Internet-Measurement","category":"research","url":"https://internet-measurement.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":3306,"proto":"tcp","label":"MySQL","count":16},{"port":161,"proto":"tcp","label":"SNMP","count":9},{"port":544,"proto":"tcp","label":"","count":5},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":4},{"port":892,"proto":"tcp","label":"","count":4},{"port":22,"proto":"tcp","label":"SSH","count":3},{"port":1494,"proto":"tcp","label":"","count":3},{"port":771,"proto":"tcp","label":"","count":3},{"port":46144,"proto":"tcp","label":"","count":2},{"port":21,"proto":"tcp","label":"FTP","count":2},{"port":8585,"proto":"tcp","label":"","count":2},{"port":9503,"proto":"tcp","label":"","count":2},{"port":11102,"proto":"tcp","label":"","count":1},{"port":6379,"proto":"tcp","label":"Redis","count":1},{"port":9083,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i300900_3c43a67630b3_e7c285222651"],"tls_client_hello":"160301010a01000106030320578990bbe79cdb9d6bde5df84620cb9c4e9fac5364aab609ee44c756a032ae20d8aae44b1f80e4cc3dd3bebcb5e41bb3967122bb9ffc3e97f470ffb6d88c7f7c003cc02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c008c012000ac024c028c023c027003c003dc007c0110005000413011302130301000081000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff010001000017000000120000002b000b0a03040303030203010300003300260024001d0020e00951acd5ecb55e229dbae1b62ce1cf84c92ad085751b32adaf655c55a2681e","tls_ja3":["7024ed8c0d80542d17159473f564b551"],"http_akin":["b10lun000_00000000_334359b9","b11cun050_00040017_6b90553b"]},"fingerprint_peers":{"t13i300900_3c43a67630b3_e7c285222651":208,"b10lun000_00000000_334359b9":2210,"b11cun050_00040017_6b90553b":1291},"akin_families":{"b10lun000_00000000_334359b9":{"head":"b10lun000_00000000_334359b9","shapes":2,"ips":2208},"b11cun050_00040017_6b90553b":{"head":"b11cun050_00040017_6b90553b","shapes":9,"ips":1291}},"user_agents":["Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)"],"timeline":[{"date":"2026-09-26","count":10}],"recent_events":[{"timestamp":"2026-09-26T15:43:33","port":6379,"proto":"tcp","app_proto":"tls","app_protocol":"drda","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u00002�\u0001\u0000\u0001\u0000,\u0010A\u0000\u0004\u0011^\u0000\u0004\u0011m\u0000\u0004\u0011Z\u0000\u0018\u0014\u0004\u0014\u0003\u0000\u0007$\u0007\u0000\b$\u000f\u0000\b\u0014@\u0000\b\u0014t\u0000\b\u0000\u0004\u0011G","payload_hex":"0032d0010001002c10410004115e0004116d0004115a001814041403000724070008240f0008144000081474000800041147","method":"","user_agent":"","ja3":"7024ed8c0d80542d17159473f564b551","session":"da05a6a0-d9cb-4a5b-b209-28ccf7357328","seq":1,"duration_ms":3101,"bytes_in":50,"bytes_out":5},{"timestamp":"2026-09-26T05:00:49","port":161,"proto":"tcp","app_proto":"","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0)\u0002\u0001\u0001\u0004\u0006public�\u001c\u0002\u0004(�Bt\u0002\u0001\u0000\u0002\u0001\u00000\u000e0\f\u0006\b+\u0006\u0001\u0002\u0001\u0002\u0001\u0000\u0005\u0000","payload_hex":"302902010104067075626c6963a01c020428a94274020100020100300e300c06082b060102010201000500","method":"","user_agent":"","ja3":"","session":"ed0aef5a-0f82-49fd-b6f5-3bd2ee8602be","seq":9,"duration_ms":16103,"bytes_in":408,"bytes_out":126,"enriched":{"digest":"8acf821676f57ddc","strings":["public"]}},{"timestamp":"2026-09-26T05:00:47","port":161,"proto":"tcp","app_proto":"","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0)\u0002\u0001\u0001\u0004\u0006public�\u001c\u0002\u0004(�Bs\u0002\u0001\u0000\u0002\u0001\u00000\u000e0\f\u0006\b+\u0006\u0001\u0002\u0001\u0001\u0007\u0000\u0005\u0000","payload_hex":"302902010104067075626c6963a01c020428a94273020100020100300e300c06082b060102010107000500","method":"","user_agent":"","ja3":"","session":"ed0aef5a-0f82-49fd-b6f5-3bd2ee8602be","seq":8,"duration_ms":14104,"bytes_in":365,"bytes_out":112,"enriched":{"digest":"b9f928127a69f89b","strings":["public"]}},{"timestamp":"2026-09-26T05:00:45","port":161,"proto":"tcp","app_proto":"","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0)\u0002\u0001\u0001\u0004\u0006public�\u001c\u0002\u0004(�Br\u0002\u0001\u0000\u0002\u0001\u00000\u000e0\f\u0006\b+\u0006\u0001\u0002\u0001\u0001\u0006\u0000\u0005\u0000","payload_hex":"302902010104067075626c6963a01c020428a94272020100020100300e300c06082b060102010106000500","method":"","user_agent":"","ja3":"","session":"ed0aef5a-0f82-49fd-b6f5-3bd2ee8602be","seq":7,"duration_ms":12105,"bytes_in":322,"bytes_out":98,"enriched":{"digest":"468ac93e99e7f2ec","strings":["public"]}},{"timestamp":"2026-09-26T05:00:43","port":161,"proto":"tcp","app_proto":"","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0)\u0002\u0001\u0001\u0004\u0006public�\u001c\u0002\u0004(�Bq\u0002\u0001\u0000\u0002\u0001\u00000\u000e0\f\u0006\b+\u0006\u0001\u0002\u0001\u0001\u0005\u0000\u0005\u0000","payload_hex":"302902010104067075626c6963a01c020428a94271020100020100300e300c06082b060102010105000500","method":"","user_agent":"","ja3":"","session":"ed0aef5a-0f82-49fd-b6f5-3bd2ee8602be","seq":6,"duration_ms":10101,"bytes_in":279,"bytes_out":84,"enriched":{"digest":"08c1340b8bea76d1","strings":["public"]}},{"timestamp":"2026-09-26T05:00:41","port":161,"proto":"tcp","app_proto":"","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0)\u0002\u0001\u0001\u0004\u0006public�\u001c\u0002\u0004(�Bp\u0002\u0001\u0000\u0002\u0001\u00000\u000e0\f\u0006\b+\u0006\u0001\u0002\u0001\u0001\u0004\u0000\u0005\u0000","payload_hex":"302902010104067075626c6963a01c020428a94270020100020100300e300c06082b060102010104000500","method":"","user_agent":"","ja3":"","session":"ed0aef5a-0f82-49fd-b6f5-3bd2ee8602be","seq":5,"duration_ms":8100,"bytes_in":236,"bytes_out":70,"enriched":{"digest":"e0ed75c9c738253f","strings":["public"]}},{"timestamp":"2026-09-26T05:00:39","port":161,"proto":"tcp","app_proto":"","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0)\u0002\u0001\u0001\u0004\u0006public�\u001c\u0002\u0004(�Bo\u0002\u0001\u0000\u0002\u0001\u00000\u000e0\f\u0006\b+\u0006\u0001\u0002\u0001\u0001\u0003\u0000\u0005\u0000","payload_hex":"302902010104067075626c6963a01c020428a9426f020100020100300e300c06082b060102010103000500","method":"","user_agent":"","ja3":"","session":"ed0aef5a-0f82-49fd-b6f5-3bd2ee8602be","seq":4,"duration_ms":6101,"bytes_in":193,"bytes_out":56,"enriched":{"digest":"cc5709ee359600a5","strings":["public"]}},{"timestamp":"2026-09-26T05:00:37","port":161,"proto":"tcp","app_proto":"","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0)\u0002\u0001\u0001\u0004\u0006public�\u001c\u0002\u0004(�Bn\u0002\u0001\u0000\u0002\u0001\u00000\u000e0\f\u0006\b+\u0006\u0001\u0002\u0001\u0001\u0002\u0000\u0005\u0000","payload_hex":"302902010104067075626c6963a01c020428a9426e020100020100300e300c06082b060102010102000500","method":"","user_agent":"","ja3":"","session":"ed0aef5a-0f82-49fd-b6f5-3bd2ee8602be","seq":3,"duration_ms":4100,"bytes_in":150,"bytes_out":42,"enriched":{"digest":"270858c665705a60","strings":["public"]}},{"timestamp":"2026-09-26T05:00:35","port":161,"proto":"tcp","app_proto":"","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0)\u0002\u0001\u0001\u0004\u0006public�\u001c\u0002\u0004(�Bm\u0002\u0001\u0000\u0002\u0001\u00000\u000e0\f\u0006\b+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0005\u0000","payload_hex":"302902010104067075626c6963a01c020428a9426d020100020100300e300c06082b060102010101000500","method":"","user_agent":"","ja3":"","session":"ed0aef5a-0f82-49fd-b6f5-3bd2ee8602be","seq":2,"duration_ms":2099,"bytes_in":107,"bytes_out":28,"enriched":{"digest":"c86a8ca71859b424","strings":["public"]}},{"timestamp":"2026-09-26T05:00:33","port":161,"proto":"tcp","app_proto":"","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0>\u0002\u0001\u00030\u0011\u0002\u0004\u0016�A�\u0002\u0003\u0000��\u0004\u0001\u0004\u0002\u0001\u0003\u0004\u00100\u000e\u0004\u0000\u0002\u0001\u0000\u0002\u0001\u0000\u0004\u0000\u0004\u0000\u0004\u00000\u0014\u0004\u0000\u0004\u0000�\u000e\u0002\u0004(�Bm\u0002\u0001\u0000\u0002\u0001\u00000\u0000","payload_hex":"303e0201033011020416d641a7020300ffe30401040201030410300e0400020100020100040004000400301404000400a00e020428a9426d0201000201003000","method":"","user_agent":"","ja3":"","session":"ed0aef5a-0f82-49fd-b6f5-3bd2ee8602be","seq":1,"duration_ms":100,"bytes_in":64,"bytes_out":14}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":21,"top_paths":[{"path":"/","count":3,"ports":3}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-02T21:38:14.428783+00:00"}