{"ip":"87.236.176.60","total_events":48,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"driftnet","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (driftnet).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"touch","label":"Touch only","detail":"0 bytes sent, no real exchange","bytes_sent":0,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-19T23:10:47","last_seen":"2026-05-03T11:01:33","events_24h":0,"events_7d":0,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"","city":"","lat":51.4964,"lon":-0.1224,"asn":211298,"org":"Driftnet Ltd"},"source_domain":"sturdy.monitoring.internet-measurement.com","known_scanners":["driftnet","Internet-Measurement"],"scanner_tag":{"key":"internet-measurement","label":"Internet-Measurement","category":"research","url":"https://internet-measurement.com/"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"quic","events":1}],"ports":[{"port":8443,"events":1}],"dns_questions":[],"quic_clients":[{"ja4":"q13i0307h9_55b375c5d22e_39d5f8cd0d4d","transport_params_hash":"60647680e335","server_name":"","events":1}],"first_seen":"2026-10-06T08:20:16","last_seen":"2026-10-06T08:20:16","recent":[{"timestamp":"2026-10-06T08:20:16","port":8443,"src_port":13700,"proto":"udp","app_proto":"quic","app_protocol":"quic","summary":"QUIC v1 Initial alpn=http/0.9,http/1.0,spdy/1,spdy/2,spdy/3,stun.turn,stun.nat-discovery,h2c,webrtc,c-webrtc,ftp,imap,pop3,managesieve,coap,co","payload_hex":"","sni":"","session":"9a31ae30-b09e-4be0-b84f-2b1c75c8d1d7","bytes_in":1200,"source_verified":false,"quic":{"version":"1","ja4":"q13i0307h9_55b375c5d22e_39d5f8cd0d4d","transport_params_hash":"60647680e335","version_negotiation":false}}]},"top_ports":[{"port":3306,"proto":"tcp","label":"MySQL","count":5},{"port":3389,"proto":"tcp","label":"RDP","count":5},{"port":46144,"proto":"tcp","label":"","count":5},{"port":1883,"proto":"tcp","label":"MQTT","count":4},{"port":80,"proto":"tcp","label":"HTTP","count":3},{"port":8585,"proto":"tcp","label":"","count":3},{"port":22,"proto":"tcp","label":"SSH","count":3},{"port":3390,"proto":"tcp","label":"","count":3},{"port":12332,"proto":"tcp","label":"","count":3},{"port":892,"proto":"tcp","label":"","count":3},{"port":1521,"proto":"tcp","label":"Oracle","count":3},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":1},{"port":7250,"proto":"tcp","label":"","count":1},{"port":20381,"proto":"tcp","label":"","count":1},{"port":1494,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b10cun000_00000000_334359b9","b11cun050_00040017_6b90553b"]},"fingerprint_peers":{"b10cun000_00000000_334359b9":2325,"b11cun050_00040017_6b90553b":1325},"akin_families":{"b10cun000_00000000_334359b9":{"head":"b10cun000_00000000_334359b9","shapes":2,"ips":2325},"b11cun050_00040017_6b90553b":{"head":"b11cun050_00040017_6b90553b","shapes":8,"ips":1332}},"user_agents":[],"timeline":[],"recent_events":[{"timestamp":"2026-05-03T11:01:33","port":3306,"proto":"tcp","app_proto":"","app_protocol":"iscsi","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000\u0000\u0000\u0000�\u0000\u0002=\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000HeaderDigest=None\u0000DataDigest=None\u0000SessionType=Discovery\u0000MaxRecvDataSegmentLength=32768\u0000InitiatorName=iqn.2003-01.com.linux-iscsi:5207156277\u0000","payload_hex":"438700000000008c00023d000000000000000000000000000000000100000000000000000000000000000000000000004865616465724469676573743d4e6f6e6500446174614469676573743d4e6f6e650053657373696f6e547970653d446973636f76657279004d617852656376446174615365676d656e744c656e6774683d333237363800496e69746961746f724e616d653d69716e2e323030332d30312e636f6d2e6c696e75782d69736373693a3532303731353632373700","method":"","user_agent":"","ja3":"","session":"4dd8ebba-87cd-4876-9ad1-0955064f8f90","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"4f9bc3b9836c1567","label":"iSCSI","strings":["HeaderDigest=None","DataDigest=None","SessionType=Discovery","MaxRecvDataSegmentLength=32768","InitiatorName=iqn.2003-01.com.linux-iscsi:5207156277","HeaderDigest=NoneDataDigest=NoneSessionType=DiscoveryMaxRecvDataSegmentLength=32…"],"iocs":{"domains":["iqn.2003-01.com.linux"]}}},{"timestamp":"2026-04-25T15:58:44","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/multistream/1.0.0\n","payload_hex":"132f6d756c746973747265616d2f312e302e300a","method":"","user_agent":"","ja3":"","session":"f0364bd6-794a-44bb-9b5a-804fc2b4ba68","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"1d02c4ee384a79c6","strings":["/multistream/1.0.0"],"iocs":{"paths":["/multistream/1.0.0"]}}},{"timestamp":"2026-04-20T12:33:45","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"6c000b000000000000000000","method":"","user_agent":"","ja3":"","session":"9b4a6892-7878-4def-ab52-8377d75bfa5a","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-04-20T12:17:55","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000�\u0000","payload_hex":"300c020101600702010304008000","method":"","user_agent":"","ja3":"","session":"7d34d952-2c85-4f8d-80d4-160d3ea819c2","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-04-20T12:14:41","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=eltons\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d656c746f6e730d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"c361844e-606c-4f9c-b401-68f8a4d32aee","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e23e10d039a0429b","strings":["Cookie: mstshash=eltons"]}},{"timestamp":"2026-04-17T02:02:22","port":8080,"proto":"tcp","app_proto":"","app_protocol":"ookla","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\n};;\n","payload_hex":"666f7820612031202d3120666f782068656c6c6f0a7b0a666f782e76657273696f6e3d733a312e300a69643d693a310a7d3b3b0a","method":"","user_agent":"","ja3":"","session":"a9f4ec05-c962-443a-ae7b-7b8867bb82a0","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ecde042f32070bf0","strings":["ox a 1 -1 fox hello","fox.version=s:1.0","id=i:1"],"iocs":{"domains":["fox.version"]}}},{"timestamp":"2026-04-17T01:14:40","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0005\u0011\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"101200044d5154540502003c0511000000000000","method":"","user_agent":"","ja3":"","session":"e7f453b5-a62d-4d16-9077-d986e5c9cfce","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e914d7e7af616e6b","strings":["MQTT"]}},{"timestamp":"2026-03-25T17:36:26","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000�\u0000","payload_hex":"300c020101600702010304008000","method":"","user_agent":"","ja3":"","session":"40a7c7c9-5098-4239-8d60-193f886379f9","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-03-24T21:41:59","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\t\u0000\u0003\u0000\u0000\u0000","payload_hex":"000000090003000000","method":"","user_agent":"","ja3":"","session":"c8415753-60a7-479d-ab06-7835aef52045","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-03-23T22:47:56","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000�\u0000","payload_hex":"300c020101600702010304008000","method":"","user_agent":"","ja3":"","session":"62891b02-d291-49fa-9a26-f4d77f04fdf9","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0}],"http_methods":[],"distinct_ports_total":19,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-11T06:48:47.471646+00:00"}