{"ip":"195.96.139.193","total_events":4,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"driftnet","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (driftnet).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"428 bytes sent","bytes_sent":428,"session_seconds":5,"persistent":false}},"first_seen":"2026-09-22T00:04:41","last_seen":"2026-09-23T10:15:14","events_24h":2,"events_7d":4,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"","city":"","lat":51.4964,"lon":-0.1224,"asn":211298,"org":"Driftnet Ltd"},"source_domain":"r5-193-c1.monitoring.internet-measurement.com","known_scanners":["driftnet","Internet-Measurement"],"scanner_tag":{"key":"internet-measurement","label":"Internet-Measurement","category":"research","url":"https://internet-measurement.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":5222,"proto":"tcp","label":"XMPP","count":2},{"port":2107,"proto":"tcp","label":"","count":1},{"port":6379,"proto":"tcp","label":"Redis","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-22","count":2},{"date":"2026-09-23","count":2}],"recent_events":[{"timestamp":"2026-09-23T10:15:14","port":2107,"proto":"tcp","app_proto":"","app_protocol":"dce_rpc","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0000\u000b\u0003\u0010\u0000\u0000\u0000H\u0000\u0000\u0000\u0001\u0000\u0000\u0000�\u0010�\u0010\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u00000���_\u0006�\u0011��\u0000�$�U%\u0001\u0000\u0000\u0000\u0004]���\u001c�\u0011��\b\u0000+\u0010H`\u0002\u0000\u0000\u0000","payload_hex":"05000b03100000004800000001000000b810b81000000000010000000000010030a0b3fd5f06d111bb9b00a024ea552501000000045d888aeb1cc9119fe808002b10486002000000","method":"","user_agent":"","ja3":"","session":"aad33dd5-1bb1-4e46-8ce3-d694bde5bf12","seq":1,"duration_ms":100,"bytes_in":72,"bytes_out":14,"enriched":{"digest":"e55af90714741aa2","label":"SOCKS5"}},{"timestamp":"2026-09-23T08:27:39","port":6379,"proto":"tcp","app_proto":"","app_protocol":"memcached","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"stats\r\n","payload_hex":"73746174730d0a","method":"","user_agent":"","ja3":"","session":"40692ec2-73e9-40f5-b61f-8dfd3ce94204","seq":1,"duration_ms":100,"bytes_in":7,"bytes_out":5,"enriched":{"digest":"8ba3dc4bf81a4992","label":"Memcached","strings":["stats"]}},{"timestamp":"2026-09-22T00:04:46","port":5222,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>","payload_hex":"3c7374617274746c7320786d6c6e733d2775726e3a696574663a706172616d733a786d6c3a6e733a786d70702d746c73272f3e","method":"","user_agent":"","ja3":"","session":"7d70cdec-b601-46de-8b40-36046a40dd3b","seq":2,"duration_ms":5100,"bytes_in":200,"bytes_out":28,"enriched":{"digest":"53a3b46814e7b833","strings":["<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>"]}},{"timestamp":"2026-09-22T00:04:41","port":5222,"proto":"tcp","app_proto":"","app_protocol":"jabber","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"<?xml version='1.0'?><stream:stream version='1.0' xml:lang='en' xmlns:stream='http://etherx.jabber.org/streams' xmlns='jabber:client' to='localhost'>","payload_hex":"3c3f786d6c2076657273696f6e3d27312e30273f3e3c73747265616d3a73747265616d2076657273696f6e3d27312e302720786d6c3a6c616e673d27656e2720786d6c6e733a73747265616d3d27687474703a2f2f6574686572782e6a61626265722e6f72672f73747265616d732720786d6c6e733d276a61626265723a636c69656e742720746f3d276c6f63616c686f7374273e","method":"","user_agent":"","ja3":"","session":"7d70cdec-b601-46de-8b40-36046a40dd3b","seq":1,"duration_ms":100,"bytes_in":149,"bytes_out":14,"enriched":{"digest":"cdbfab113754b9fc","label":"SOAP/XML","strings":["<?xml version='1.0'?><stream:stream version='1.0' xml:lang='en' xmlns:stream='ht…"]}}],"http_methods":[],"distinct_ports_total":3,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-23T16:01:57.022898+00:00"}