{"ip":"193.174.89.19","total_events":2749,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"universities","confidence":"high","network_type":"educational/research","why":["Source IP is in a known scanner range (universities).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"46,562 bytes sent","bytes_sent":46562,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-19T13:19:15","last_seen":"2026-08-13T03:18:09","events_24h":0,"events_7d":89,"geo":{"country_code":"DE","country_name":"Germany","region":"Bavaria","city":"Würzburg","lat":49.8022,"lon":9.9053,"asn":680,"org":"Verein zur Foerderung eines Deutschen Forschungsnetzes e.V."},"source_domain":"fb02itsscan02.fh-muenster.de","known_scanners":["universities","DFN Deutsches Forschungsnetz e.V."],"scanner_tag":{"key":"peeringdb:as680","label":"DFN Deutsches Forschungsnetz e.V.","category":"research","url":"https://www.peeringdb.com/asn/680"},"cve_matches":[],"malware":[],"top_ports":[{"port":3000,"proto":"tcp","label":"Web-alt","count":242},{"port":80,"proto":"tcp","label":"HTTP","count":217},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":201},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":184},{"port":8085,"proto":"tcp","label":"","count":183},{"port":8082,"proto":"tcp","label":"","count":175},{"port":8089,"proto":"tcp","label":"Splunk","count":174},{"port":8090,"proto":"tcp","label":"","count":173},{"port":9080,"proto":"tcp","label":"","count":169},{"port":8083,"proto":"tcp","label":"","count":168},{"port":9000,"proto":"tcp","label":"Web-alt","count":166},{"port":8081,"proto":"tcp","label":"","count":158},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":115},{"port":8042,"proto":"tcp","label":"","count":71},{"port":443,"proto":"tcp","label":"HTTPS","count":60}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1909h2_9dc949149365_97f8aa674fd9","t12i130500_2d7513195f68_e51b7354d87f","t13i291200_723694b0fccc_2cc26d266019"],"tls_ja3":["3f15b7d048d957fcce92b909c22feeb8","d65bc0463e8abd294f7c3a08f5225e37","fc6971dd383392bf57fc0c3e4a04a8c5","c6024eb71ad9164d3188d3d4f2acabbc"],"ja4h":["ge11nn0400_88d30a62b7ad","ge11nn0500_b2ce8913985b"]},"fingerprint_peers":{"t13i291200_723694b0fccc_2cc26d266019":8,"t13i1909h2_9dc949149365_97f8aa674fd9":562,"t12i130500_2d7513195f68_e51b7354d87f":2149,"ge11nn0400_88d30a62b7ad":4815},"user_agents":["fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)","Mozilla/5.0 zgrab2-dicomweb/1.0"],"timeline":[{"date":"2026-05-19","count":5},{"date":"2026-06-10","count":7},{"date":"2026-06-12","count":7},{"date":"2026-06-13","count":14},{"date":"2026-06-22","count":7},{"date":"2026-06-25","count":41},{"date":"2026-06-26","count":40},{"date":"2026-06-27","count":81},{"date":"2026-07-02","count":15},{"date":"2026-07-20","count":6},{"date":"2026-07-21","count":1},{"date":"2026-07-22","count":9},{"date":"2026-07-23","count":6},{"date":"2026-08-10","count":15},{"date":"2026-08-11","count":21},{"date":"2026-08-12","count":37},{"date":"2026-08-13","count":16}],"recent_events":[{"timestamp":"2026-08-13T03:18:09","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dicom-web/studies?00080020=30000101","summary":"","payload_hex":"474554202f6469636f6d2d7765622f737475646965733f30303038303032303d333030303031303120485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a2066686d732d6974732d72657365617263682d7363616e6e65722f312e3020282b68747470733a2f2f666230326974737363616e30322e66682d6d75656e737465722e6465290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","session":"8decd440-ce13-4f7a-bd3d-1cdc04e5a530","seq":1,"duration_ms":100,"bytes_in":198,"bytes_out":78},{"timestamp":"2026-08-13T03:18:07","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dcm4chee-arc/aets/DCM4CHEE/rs/studies?00080020=30000101","summary":"","payload_hex":"474554202f64636d34636865652d6172632f616574732f44434d34434845452f72732f737475646965733f30303038303032303d333030303031303120485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a2066686d732d6974732d72657365617263682d7363616e6e65722f312e3020282b68747470733a2f2f666230326974737363616e30322e66682d6d75656e737465722e6465290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","session":"de854cce-f554-4a01-bb84-2bf1227cc7a5","seq":1,"duration_ms":100,"bytes_in":218,"bytes_out":78},{"timestamp":"2026-08-13T03:18:05","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dcm4chee-arc/ui2/","summary":"","payload_hex":"474554202f64636d34636865652d6172632f7569322f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a2066686d732d6974732d72657365617263682d7363616e6e65722f312e3020282b68747470733a2f2f666230326974737363616e30322e66682d6d75656e737465722e6465290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","session":"67ee63fb-c309-4b87-8309-1134b97a60cc","seq":1,"duration_ms":104,"bytes_in":180,"bytes_out":78},{"timestamp":"2026-08-13T03:18:03","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a2066686d732d6974732d72657365617263682d7363616e6e65722f312e3020282b68747470733a2f2f666230326974737363616e30322e66682d6d75656e737465722e6465290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","session":"3ae4bac7-4af7-414c-a285-e2698617f939","seq":1,"duration_ms":100,"bytes_in":163,"bytes_out":78},{"timestamp":"2026-08-13T02:46:13","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dicom-web/studies?00080020=30000101","summary":"","payload_hex":"474554202f6469636f6d2d7765622f737475646965733f30303038303032303d333030303031303120485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a2066686d732d6974732d72657365617263682d7363616e6e65722f312e3020282b68747470733a2f2f666230326974737363616e30322e66682d6d75656e737465722e6465290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","session":"ff1e3ee8-0d92-4888-80bf-0d918665f66d","seq":1,"duration_ms":101,"bytes_in":197,"bytes_out":78},{"timestamp":"2026-08-13T02:46:13","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dicom-web/studies?00080020=30000101","summary":"","payload_hex":"474554202f6469636f6d2d7765622f737475646965733f30303038303032303d333030303031303120485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a2066686d732d6974732d72657365617263682d7363616e6e65722f312e3020282b68747470733a2f2f666230326974737363616e30322e66682d6d75656e737465722e6465290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","session":"1a95334a-7492-4cba-a8e9-5a676cc20d5c","seq":1,"duration_ms":100,"bytes_in":197,"bytes_out":78},{"timestamp":"2026-08-13T02:46:11","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dcm4chee-arc/aets/DCM4CHEE/rs/studies?00080020=30000101","summary":"","payload_hex":"474554202f64636d34636865652d6172632f616574732f44434d34434845452f72732f737475646965733f30303038303032303d333030303031303120485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a2066686d732d6974732d72657365617263682d7363616e6e65722f312e3020282b68747470733a2f2f666230326974737363616e30322e66682d6d75656e737465722e6465290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","session":"c3a0a08b-92fb-4f7f-b01e-14a21d05200a","seq":1,"duration_ms":100,"bytes_in":217,"bytes_out":78},{"timestamp":"2026-08-13T02:46:11","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dcm4chee-arc/aets/DCM4CHEE/rs/studies?00080020=30000101","summary":"","payload_hex":"474554202f64636d34636865652d6172632f616574732f44434d34434845452f72732f737475646965733f30303038303032303d333030303031303120485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a2066686d732d6974732d72657365617263682d7363616e6e65722f312e3020282b68747470733a2f2f666230326974737363616e30322e66682d6d75656e737465722e6465290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","session":"7eca8a7f-5e24-41f9-a389-e2ad0c0f4bc0","seq":1,"duration_ms":100,"bytes_in":217,"bytes_out":78},{"timestamp":"2026-08-13T02:46:09","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dcm4chee-arc/ui2/","summary":"","payload_hex":"474554202f64636d34636865652d6172632f7569322f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a2066686d732d6974732d72657365617263682d7363616e6e65722f312e3020282b68747470733a2f2f666230326974737363616e30322e66682d6d75656e737465722e6465290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","session":"61d18024-48a7-41f3-bc8f-a42004622508","seq":1,"duration_ms":100,"bytes_in":179,"bytes_out":78},{"timestamp":"2026-08-13T02:46:09","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dcm4chee-arc/ui2/","summary":"","payload_hex":"474554202f64636d34636865652d6172632f7569322f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a2066686d732d6974732d72657365617263682d7363616e6e65722f312e3020282b68747470733a2f2f666230326974737363616e30322e66682d6d75656e737465722e6465290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","session":"3fb4a709-10b8-4b21-af40-ae3bd828748d","seq":1,"duration_ms":100,"bytes_in":179,"bytes_out":78}],"http_methods":[{"method":"GET","count":1307}],"distinct_ports_total":37,"top_paths":[{"path":"/fhir/metadata","count":81,"ports":14},{"path":"/metadata","count":71,"ports":14},{"path":"/r5/metadata","count":69,"ports":14},{"path":"/r2/metadata","count":68,"ports":13},{"path":"/baseR3/metadata","count":68,"ports":14},{"path":"/baseDstu2/metadata","count":67,"ports":14},{"path":"/baseR5/metadata","count":66,"ports":13},{"path":"/r3/metadata","count":65,"ports":14},{"path":"/baseR4/metadata","count":64,"ports":13},{"path":"/","count":64,"ports":8},{"path":"/fhir/r4/metadata","count":58,"ports":13},{"path":"/baseDstu3/metadata","count":58,"ports":14},{"path":"/baseR2/metadata","count":57,"ports":13},{"path":"/fhir-server/api/v4/metadata","count":56,"ports":14},{"path":"/r4/metadata","count":54,"ports":14}],"distinct_paths_total":38,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":96}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:8443","notable":false},{"name":"User-Agent","value":"fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-14T17:51:25.369782+00:00"}