{"ip":"195.96.139.189","total_events":2,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"driftnet","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (driftnet).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"101 bytes sent","bytes_sent":101,"session_seconds":3,"persistent":false}},"first_seen":"2026-09-23T08:27:22","last_seen":"2026-09-23T08:36:01","events_24h":0,"events_7d":0,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"","city":"","lat":51.4964,"lon":-0.1224,"asn":211298,"org":"Driftnet Ltd"},"source_domain":"r5-189-bd.monitoring.internet-measurement.com","known_scanners":["driftnet","Internet-Measurement"],"scanner_tag":{"key":"internet-measurement","label":"Internet-Measurement","category":"research","url":"https://internet-measurement.com/"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"quic","events":1}],"ports":[{"port":443,"events":1}],"dns_questions":[],"quic_clients":[{"ja4":"q13i0307h9_55b375c5d22e_2f871f65fa7d","transport_params_hash":"60647680e335","server_name":"","events":1}],"first_seen":"2026-10-06T01:02:23","last_seen":"2026-10-06T01:02:23","recent":[{"timestamp":"2026-10-06T01:02:23","port":443,"src_port":13745,"proto":"udp","app_proto":"quic","app_protocol":"quic","summary":"QUIC v1 Initial alpn=http/0.9,http/1.0,spdy/1,spdy/2,spdy/3,stun.turn,stun.nat-discovery,h2c,webrtc,c-webrtc,ftp,imap,pop3,managesieve,coap,co","payload_hex":"","sni":"","session":"9f89e489-adc3-4fcf-ad68-e6378d8a040d","bytes_in":1200,"source_verified":false,"quic":{"version":"1","ja4":"q13i0307h9_55b375c5d22e_2f871f65fa7d","transport_params_hash":"60647680e335","version_negotiation":false}}]},"top_ports":[{"port":6379,"proto":"tcp","label":"Redis","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i300900_3c43a67630b3_e7c285222651"],"tls_client_hello":"160301010a01000106030396c313b07465d2f9d394613712ab4509862422a5a24eb71421ec679e3ae5246d20c5bd095f1f7d947b3e26d78dbac4c98543161310f04fc2d597fcd373ca033cbf003cc02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c008c012000ac024c028c023c027003c003dc007c0110005000413011302130301000081000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff010001000017000000120000002b000b0a03040303030203010300003300260024001d0020b0792c9825e4aa08457c083552b7795735c8cf0607baccacbf63b4cdcdfd9b3c","tls_ja3":["7024ed8c0d80542d17159473f564b551"],"http_akin":[]},"fingerprint_peers":{"t13i300900_3c43a67630b3_e7c285222651":204},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-23","count":2}],"recent_events":[{"timestamp":"2026-09-23T08:36:01","port":6379,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"@\u0000\r\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000Q\u0004��8\u0001\u0000\u0000\u0000\u0000\n\u0000\u0000\u0000<\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"40000d00010000000000000000005104c0a83801000000000a0000003c000000c800000000000000000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"7024ed8c0d80542d17159473f564b551","session":"f38c6ed3-8452-44e8-8b66-f601ad92cdef","seq":1,"duration_ms":3101,"bytes_in":64,"bytes_out":5},{"timestamp":"2026-09-23T08:27:22","port":6379,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT\naccept-version:1.0,1.1,2.0\n\n\u0000","payload_hex":"434f4e4e4543540a6163636570742d76657273696f6e3a312e302c312e312c322e300a0a00","method":"","user_agent":"","ja3":"","session":"f2305a9a-0751-4f50-b4b8-acb43878cb8e","seq":1,"duration_ms":100,"bytes_in":37,"bytes_out":5,"enriched":{"digest":"56e11d3b2a19dd60","strings":["CONNECT","accept-version:1.0,1.1,2.0"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-12T08:12:03.727898+00:00"}