{"ip":"87.236.176.182","total_events":43,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"driftnet","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (driftnet).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"touch","label":"Touch only","detail":"12 bytes sent, no real exchange","bytes_sent":12,"session_seconds":3,"persistent":false}},"first_seen":"2026-02-19T04:53:33","last_seen":"2026-09-23T08:30:23","events_24h":0,"events_7d":2,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"","city":"","lat":51.4964,"lon":-0.1224,"asn":211298,"org":"Driftnet Ltd"},"source_domain":"r3-182-b6.monitoring.internet-measurement.com","known_scanners":["driftnet","Internet-Measurement"],"scanner_tag":{"key":"internet-measurement","label":"Internet-Measurement","category":"research","url":"https://internet-measurement.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":7},{"port":22,"proto":"tcp","label":"SSH","count":5},{"port":5200,"proto":"tcp","label":"","count":3},{"port":30104,"proto":"tcp","label":"","count":3},{"port":11015,"proto":"tcp","label":"","count":2},{"port":6379,"proto":"tcp","label":"Redis","count":2},{"port":3306,"proto":"tcp","label":"MySQL","count":2},{"port":1988,"proto":"tcp","label":"","count":2},{"port":7025,"proto":"tcp","label":"","count":2},{"port":61614,"proto":"tcp","label":"","count":1},{"port":42117,"proto":"tcp","label":"","count":1},{"port":6020,"proto":"tcp","label":"","count":1},{"port":32795,"proto":"tcp","label":"","count":1},{"port":2225,"proto":"tcp","label":"","count":1},{"port":36505,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i300900_3c43a67630b3_e7c285222651"],"tls_client_hello":"160301010a010001060303bcdbfe2d53b71414ec3a7560bb71fde64accbb9a108915c3e9f93e2e43db245920fc7f383e1087ca2c6b58f9b5729cba7756a9f479dc46e751df9a3611ad785b8a003cc02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c008c012000ac024c028c023c027003c003dc007c0110005000413011302130301000081000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff010001000017000000120000002b000b0a03040303030203010300003300260024001d00201eaafd3cad61f8de8839ad3b53bab87422ece53eb3830363cf277ae8c6e39349","tls_ja3":["7024ed8c0d80542d17159473f564b551"],"http_akin":[]},"fingerprint_peers":{"t13i300900_3c43a67630b3_e7c285222651":146},"akin_families":{},"user_agents":["Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)"],"timeline":[{"date":"2026-09-23","count":2}],"recent_events":[{"timestamp":"2026-09-23T08:30:23","port":6379,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0004\u0001yhW찶\u0000","payload_hex":"0401796857ecb0b600","method":"","user_agent":"","ja3":"7024ed8c0d80542d17159473f564b551","session":"8f2b2b2c-020e-44d7-b71c-940e50c0aa59","seq":1,"duration_ms":101,"bytes_in":9,"bytes_out":5},{"timestamp":"2026-09-23T08:30:21","port":6379,"proto":"tcp","app_proto":"tls","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"7024ed8c0d80542d17159473f564b551","session":"ba4d2419-4127-4063-81c9-0ecdf43444c3","seq":1,"duration_ms":3107,"bytes_in":3,"bytes_out":5,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-05-03T16:22:04","port":6020,"proto":"tcp","app_proto":"","app_protocol":"dicom","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP         ECHOSCU         \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000:Q\u0000\u0000\u0004\u0000\u0000\u0000\u0000R\u0000\u0000\u001b1.2.276.0.7230010.3.0.3.6.2U\u0000\u0000\u000fOFFIS_DCMTK_362","payload_hex":"0100000000cd00010000414e592d5343502020202020202020204543484f534355202020202020202020000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100000030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000003a51000004000000005200001b312e322e3237362e302e373233303031302e332e302e332e362e325500000f4f464649535f44434d544b5f333632","method":"","user_agent":"","ja3":"","session":"e2c2bedf-e06d-4853-a732-c75d05abb377","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"bf9ab6cd5a9b8b03","label":"DICOM","strings":["ANY-SCP         ECHOSCU","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.276.0.7230010.3.0.3.6.2U","OFFIS_DCMTK_362","1.2.840.10008.3.1.1.1 .","1.2.840.10008.1.2P:Q"]}},{"timestamp":"2026-05-03T16:07:19","port":1988,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���version\u0000\u0000\u0000\u0000\u0000V\u0000\u0000\u0000�ŭv�\u0011\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�r�i\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000\u0001 �\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000\u0001 �\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"f9beb4d976657273696f6e000000000056000000f5c5ad76801101000000000000000000b572f76900000000000000000000000000000000000000000000ffff7f000001208d000000000000000000000000000000000000ffff7f000001208d0000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"6fefc360-5390-4ba3-96b7-0a7d81de3474","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"6eb8e72c774e55af","strings":["version","versionV"]}},{"timestamp":"2026-05-03T16:07:17","port":1988,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�yͽ�����O\u0002�1f����\u0015��\u0010�4��5�{K�G=\b�4Aͭ�պb�)Iйfҥ���o�;�\u001e�/(��M�ED���Y�$\u0016/q��y@���Yd\b��:��g���`?�\u0001�z\u0014a}�r�Otm�C7��1+_\\�\u0010\n�=�V1��e�fy\u000b�\n��G��C�@\u0014�BY�*�OE�6]\u000fLģ�,s'S��hC�����9h9\u000b⌶ ��,[z\u000f�C\u001a�կ�\t�w\u0018��΅.\u00001\u000f��\u000f%\u0002���V?��A_\u0002�a����[Kc�\u0005��!$�\u001dD9\u0019�.��\u0019�\u0010��/H�Ů\\����x\u0000�)}sK�Q3J�\u001b$�\"��\r��==_\u0015�ވl�ǿq�V�� ���\u0019{ݮ:��Q�Գ��T�","payload_hex":"d39179cdbda8abbbe8874f02c73166859ca58415b29c10f03498cb35957b4b92473d08eb3441cdade1d5ba62e32949d0b966d2a5f984cf6fdf3bff1ec02f28f78d4dda4544908fd359d724162f71dccf79408dd9d1596408e2c43af0d4679c94a4603fd801967a14617db372ee4f746df84337ffdb312b5f5c9a100ae13de5563199d565df66790bdb0af3ee47c0b843a84014954259e52ac14f45f5365d0f4cc4a3aa2c732753d9ed6843a9fcbbdad13968390be28cb620a6ec2c5b7a0fe1431ad3d5afb409b77718b895ce852e00310fe3c70f2502a9c09e563ffeb1415f02bf618c8bcbc95b4b63bc05c7c12124f11d443919e42ea1f619bd109a822f4899c5ae5cc4dafadc7800c2297d734ba051334acc1b24cb22c4c00da6e63d3d5f15a8de886cedc7bf719a56dcc5208b8ec3197bddae3a869151cfd4b3a97f9954d4","method":"","user_agent":"","ja3":"","session":"00f25c6c-bed4-41dd-8de5-389f36f19b20","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ae5620060995557e","strings":["1+_\\",",s'S",")}sK"]}},{"timestamp":"2026-04-28T23:28:44","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/multistream/1.0.0\n","payload_hex":"132f6d756c746973747265616d2f312e302e300a","method":"","user_agent":"","ja3":"","session":"64a9fbf8-b1d5-43a2-9411-7041c4191ae9","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"1d02c4ee384a79c6","strings":["/multistream/1.0.0"],"iocs":{"paths":["/multistream/1.0.0"]}}},{"timestamp":"2026-04-24T03:51:34","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001yhW찶\u0000","payload_hex":"0401796857ecb0b600","method":"","user_agent":"","ja3":"","session":"e55a7f52-f9eb-4a07-a670-c14328bbce54","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-04-24T03:51:32","port":3306,"proto":"tcp","app_proto":"","app_protocol":"websocket","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"a7978b59-cc99-4f37-ba10-e635b43279c6","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-04-13T04:16:48","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000(D��C\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002844a3e0430000000000000002000186a0000000040000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"61d6c053-d156-4e10-9130-85750eda7abe","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-04-10T05:01:27","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"009c00011a2b3c4d00010000010000000000000300000003000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"fca053bb-6d1c-481b-8e12-73deeeaa899a","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":24,"top_paths":[{"path":"/","count":2,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-24T13:01:31.601686+00:00"}