{"ip":"195.96.139.149","total_events":2,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"driftnet","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (driftnet).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"touch","label":"Touch only","detail":"37 bytes sent, no real exchange","bytes_sent":37,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-24T03:52:51","last_seen":"2026-09-24T03:52:53","events_24h":0,"events_7d":0,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"","city":"","lat":51.4964,"lon":-0.1224,"asn":211298,"org":"Driftnet Ltd"},"source_domain":"r5-149-95.monitoring.internet-measurement.com","known_scanners":["driftnet","Internet-Measurement"],"scanner_tag":{"key":"internet-measurement","label":"Internet-Measurement","category":"research","url":"https://internet-measurement.com/"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"quic","events":1}],"ports":[{"port":443,"events":1}],"dns_questions":[],"quic_clients":[{"ja4":"q13i0207h9_62ed6f6ca7ad_95b521733d99","transport_params_hash":"4c2cac1ef1cb","server_name":"","events":1}],"first_seen":"2026-10-06T01:10:16","last_seen":"2026-10-06T01:10:16","recent":[{"timestamp":"2026-10-06T01:10:16","port":443,"src_port":14612,"proto":"udp","app_proto":"quic","app_protocol":"quic","summary":"QUIC v1 Initial alpn=h3-29,h3","payload_hex":"","sni":"","session":"98e7264a-a705-4621-9a78-1699cbb25288","bytes_in":1200,"source_verified":false,"quic":{"version":"1","ja4":"q13i0207h9_62ed6f6ca7ad_95b521733d99","transport_params_hash":"4c2cac1ef1cb","version_negotiation":false}}]},"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-24","count":2}],"recent_events":[{"timestamp":"2026-09-24T03:52:53","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"fa2e4c87-dbf6-4242-b88f-f484b7c4bd22","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":7},{"timestamp":"2026-09-24T03:52:51","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��\u0018��\u0018\u0000IBM-3279-4-E����\u0019��\u0019��\u0000��\u0000","payload_hex":"fffb18fffa180049424d2d333237392d342d45fff0fffb19fffd19fffb00fffd00","method":"","user_agent":"","ja3":"","session":"e19f37e8-c8d8-4e28-9ef5-c831a62c2181","seq":1,"duration_ms":101,"bytes_in":33,"bytes_out":12,"enriched":{"digest":"2748a40c5369382f","strings":["IBM-3279-4-E"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-12T08:57:03.794467+00:00"}