{"ip":"195.96.139.182","total_events":2,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"driftnet","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (driftnet).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"touch","label":"Touch only","detail":"25 bytes sent, no real exchange","bytes_sent":25,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-23T15:34:50","last_seen":"2026-09-23T15:36:23","events_24h":0,"events_7d":0,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"","city":"","lat":51.4964,"lon":-0.1224,"asn":211298,"org":"Driftnet Ltd"},"source_domain":"r5-182-b6.monitoring.internet-measurement.com","known_scanners":["driftnet","Internet-Measurement"],"scanner_tag":{"key":"internet-measurement","label":"Internet-Measurement","category":"research","url":"https://internet-measurement.com/"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"quic","events":1}],"ports":[{"port":443,"events":1}],"dns_questions":[],"quic_clients":[{"ja4":"q13i0310h3_55b375c5d22e_3db21c8b774f","transport_params_hash":"1f7a23748abd","server_name":"","events":1}],"first_seen":"2026-10-06T00:59:12","last_seen":"2026-10-06T00:59:12","recent":[{"timestamp":"2026-10-06T00:59:12","port":443,"src_port":12839,"proto":"udp","app_proto":"quic","app_protocol":"quic","summary":"QUIC v1 Initial alpn=h3,h3-29","payload_hex":"","sni":"","session":"122da740-2b54-450e-a5db-33ff55df0398","bytes_in":1200,"source_verified":false,"quic":{"version":"1","ja4":"q13i0310h3_55b375c5d22e_3db21c8b774f","transport_params_hash":"1f7a23748abd","version_negotiation":false}}]},"top_ports":[{"port":27017,"proto":"tcp","label":"MongoDB","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-23","count":2}],"recent_events":[{"timestamp":"2026-09-23T15:36:23","port":27017,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013/multistream/1.0.0\n","payload_hex":"132f6d756c746973747265616d2f312e302e300a","method":"","user_agent":"","ja3":"","session":"ec4155cb-df17-41c4-91fc-c767eafa2b56","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":14,"enriched":{"digest":"f5e047c2d78a8ec6","strings":["/multistream/1.0.0"],"iocs":{"paths":["/multistream/1.0.0"]}}},{"timestamp":"2026-09-23T15:34:50","port":27017,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0001","payload_hex":"0100000001","method":"","user_agent":"","ja3":"","session":"506d22ee-c070-4270-84f9-afe2c077d275","seq":1,"duration_ms":100,"bytes_in":5,"bytes_out":14}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-12T09:20:14.822576+00:00"}