{"ip":"87.236.176.230","total_events":60,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"driftnet","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (driftnet).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"197 bytes sent","bytes_sent":197,"session_seconds":3,"persistent":false}},"first_seen":"2026-02-19T10:04:23","last_seen":"2026-06-13T08:07:14","events_24h":0,"events_7d":0,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"","city":"","lat":51.4964,"lon":-0.1224,"asn":211298,"org":"Driftnet Ltd"},"source_domain":"r3-230-e6.monitoring.internet-measurement.com","known_scanners":["driftnet","Internet-Measurement"],"scanner_tag":{"key":"internet-measurement","label":"Internet-Measurement","category":"research","url":"https://internet-measurement.com/"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"quic","events":1}],"ports":[{"port":8443,"events":1}],"dns_questions":[],"quic_clients":[{"ja4":"q13i0207h9_62ed6f6ca7ad_95b521733d99","transport_params_hash":"4c2cac1ef1cb","server_name":"","events":1}],"first_seen":"2026-10-09T05:54:24","last_seen":"2026-10-09T05:54:24","recent":[{"timestamp":"2026-10-09T05:54:24","port":8443,"src_port":13644,"proto":"udp","app_proto":"quic","app_protocol":"quic","summary":"QUIC v1 Initial alpn=h3-29,h3","payload_hex":"","sni":"","session":"302b8baf-6f95-419c-b53b-ea15cce40433","bytes_in":1200,"source_verified":false,"quic":{"version":"1","ja4":"q13i0207h9_62ed6f6ca7ad_95b521733d99","transport_params_hash":"4c2cac1ef1cb","version_negotiation":false}}]},"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":8},{"port":3306,"proto":"tcp","label":"MySQL","count":7},{"port":2049,"proto":"tcp","label":"NFS","count":4},{"port":8089,"proto":"tcp","label":"Splunk","count":4},{"port":22,"proto":"tcp","label":"SSH","count":3},{"port":789,"proto":"tcp","label":"","count":2},{"port":20025,"proto":"tcp","label":"","count":2},{"port":8610,"proto":"tcp","label":"","count":2},{"port":445,"proto":"tcp","label":"SMB","count":2},{"port":8301,"proto":"tcp","label":"","count":2},{"port":20107,"proto":"tcp","label":"","count":2},{"port":98,"proto":"tcp","label":"","count":2},{"port":502,"proto":"tcp","label":"","count":2},{"port":21613,"proto":"tcp","label":"","count":2},{"port":541,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i300900_3c43a67630b3_e7c285222651"],"tls_client_hello":"","tls_ja3":["7024ed8c0d80542d17159473f564b551"],"http_akin":["b11cun050_00040017_6b90553b"]},"fingerprint_peers":{"t13i300900_3c43a67630b3_e7c285222651":204,"b11cun050_00040017_6b90553b":1341},"akin_families":{"b11cun050_00040017_6b90553b":{"head":"b11cun050_00040017_6b90553b","shapes":10,"ips":1341}},"user_agents":["Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)"],"timeline":[],"recent_events":[{"timestamp":"2026-06-13T08:07:14","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e7465726e65744d6561737572656d656e742f312e303b202b68747470733a2f2f696e7465726e65742d6d6561737572656d656e742e636f6d2f290d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)","ja3":"7024ed8c0d80542d17159473f564b551","session":"5111670a-3a08-4c2c-a48f-05ddb01b7953","seq":1,"duration_ms":3106,"bytes_in":197,"bytes_out":79},{"timestamp":"2026-05-10T06:37:25","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e7465726e65744d6561737572656d656e742f312e303b202b68747470733a2f2f696e7465726e65742d6d6561737572656d656e742e636f6d2f290d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)","ja3":"","session":"821e177b-e1a7-41e2-92a9-3be0ae001a2b","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-04-02T15:13:55","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/multistream/1.0.0\n","payload_hex":"132f6d756c746973747265616d2f312e302e300a","method":"","user_agent":"","ja3":"","session":"a145f1f5-ec2f-4cad-b849-e8d9c0252052","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"1d02c4ee384a79c6","strings":["/multistream/1.0.0"],"iocs":{"paths":["/multistream/1.0.0"]}}},{"timestamp":"2026-04-01T17:02:03","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000�\u0000","payload_hex":"300c020101600702010304008000","method":"","user_agent":"","ja3":"","session":"d84ac400-615e-4d79-bf74-40125b9dda88","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-03-25T05:13:46","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ELFD\u0000\u0000\u0000\u0000\u0000\u0000\u0000������\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0000\u0000opc.tcp://localhost:4840/UADiscovery","payload_hex":"48454c464400000000000000ffffff7fffffff7f0000000000000000240000006f70632e7463703a2f2f6c6f63616c686f73743a343834302f5541446973636f76657279","method":"","user_agent":"","ja3":"","session":"11aa3b65-baed-4ecd-84f4-1487cd489e1a","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a95d9567a4a36030","strings":["ELFD","opc.tcp://localhost:4840/UADiscovery","$opc.tcp://localhost:4840/UADiscovery"],"iocs":{"domains":["opc.tcp"]}}},{"timestamp":"2026-03-25T05:13:11","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���version\u0000\u0000\u0000\u0000\u0000V\u0000\u0000\u0000��h��\u0011\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�n�i\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000\u0001 �\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000\u0001 �\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"f9beb4d976657273696f6e000000000056000000fd9c68a4801101000000000000000000e56ec36900000000000000000000000000000000000000000000ffff7f000001208d000000000000000000000000000000000000ffff7f000001208d0000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"4284b570-521d-49f3-ab92-d0aec7445961","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a550d6576f18f76f","strings":["version","versionV"]}},{"timestamp":"2026-03-25T05:13:09","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"o\u0006\u0019i�C\u000f%�\u001b}�\"\u0003\u000bB)x챃���t\u0002��!iPs��%\u0014��6\n�\u00155�����\u0005��:M���4@x,��#m|>ԣj��o�&���[�ы\u0005��fGA=j\u000eH�\f�d*z��\u0002�\u001aP\u001b\u0011\u0012\rɚңy�\u0002���\u0006�����\u0016ϖX\u0013a*�\u0013k0�/�X\u0003���Z��K�y�\u000e\b}9qM�\u001b6F�r�}6\u0004LJ��\\��\u0017\u000b���1���Yd�\u000b��]�\r}�;!�\u0016\u001f���?r�1\u0017ϖ}[�������\u0007��cIr8N�-�[��Z\u001d�����󽶄�M����w�l��(���U>�ۡf~�r���wS\"�X��[�#\u001eܗ�&g\u0003\u0007�\u000f\"�ե�7�R��<��ł\u0015\u0012�3�YM�?�C\u001b�","payload_hex":"f76f061969ac7f430f25f61b7d9222030b422978ecb18388b7d57402dae521695073bfa72514a6d5360af91535d5dfe07fab7ff605afec3a4d80bd993440782c94c5236d7c3ed4a36ae3ac6ff826e2fdbf5bd4d18b059a9e6647413d6a0e48ff0ca8642a7afc8b02cd1a501b11120dc99ad2a3798a02ec8ce50685c6d7f4c016cf965813612ad4136b30b12fdc5803fa83b75ae6fe4b9179a50e087d39714da31b36468f72e47d3604c787eadf5c8bbe170b98efd83198b39c5964ac0bcafa5dcb0d7db03b2198161fe1e4de3f72ef3117cf967d5bf9be8ffdf980a607ccf0634972384eef2dcb5b89a35a1dfda6c2fce6f3bdb684ce4d9d9281b277db6cb2c928aebed5553e97dba1667e9972f1ded5775322e358eb8e5bd4231edc97f126670307de0f22c1d5a58a37d952adbb3caaa7c58215129933e7594d823f84431bd7","method":"","user_agent":"","ja3":"","session":"dc6a5e92-d272-46a4-b399-762116e6b0c5","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3c87052edc04833c","strings":["!iPs","4@x,","#m|>","fGA=j","}9qM","cIr8N"]}},{"timestamp":"2026-03-19T14:57:40","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000\u001a\u0000\u0000\u0000\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\b\u0000\u0001U\u0000\u0000\u0001","payload_hex":"1201001a0000000000000b00060100110001ff08000155000001","method":"","user_agent":"","ja3":"","session":"f7847d90-dde3-41eb-a408-155a15be05de","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-03-17T16:55:55","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u000e8U^�Af�%<\u0000\u0000\u0000\u0000\u0000","payload_hex":"000e38555edc4166d6253c0000000000","method":"","user_agent":"","ja3":"","session":"4f0070c2-69c4-4881-ab34-c619ff076182","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-03-17T16:54:43","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000(b�\u001cK\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002862931c4b0000000000000002000186a0000000040000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"b9ec7b21-a2ef-4bde-b661-3f5d86e78fcf","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0}],"http_methods":[{"method":"GET","count":6}],"distinct_ports_total":29,"top_paths":[{"path":"/","count":6,"ports":6}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8443","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[],"data_as_of":"2026-10-12T09:03:25.158372+00:00"}