{"ip":"134.122.117.129","total_events":50,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"binaryedge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (binaryedge).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,693 bytes sent","bytes_sent":5693,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-31T19:32:29","last_seen":"2026-09-27T12:52:41","events_24h":0,"events_7d":3,"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"North Bergen","lat":40.7964,"lon":-74.0203,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"nyc1-8.iodine.do.prod.binaryedge.ninja","known_scanners":["binaryedge","BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":2048,"proto":"tcp","label":"","count":46},{"port":443,"proto":"tcp","label":"HTTPS","count":3},{"port":8086,"proto":"tcp","label":"InfluxDB","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i2511h2_b78ed14e2fd0_ab7e3b40a677","t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"16030105f4010005f00303cc38d4696e6e302fed03e8eaf904542a8481488286b6cc409f6323359fadd6bb20295c7a47155983529293eb3b830818bfc41a1a047f7cb9dd42c3b43b5bcd582a0032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000575000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a00180804040308070805080604010501060105030603020102030010000e000c02683208687474702f312e31002b0009080304030303020301003304ea04e811ec04c0b8e2965a164d39ec08fd8958d0373ff086bd9b2c5cc6a54e9587a0d3e3bab18ac77e98903c9053395b3dfed804a490b22117ca37f656c886b40746608eeaaecf36bd39435ec95133b32b230af7b6df3b4d23150168634aca4126ec83192b9aacb39945dbda6fc0050aa87989f3b35e8c7564ca009068869593361d06d29af4e09fec6b4bc5163a0496a7cfc6b7c89c095b53c67085ba9e4324ca875b3a62aaf98990cbf4543241bd24db6fa132ba5ea28ae833c9ad35a4c207230c8786ccb9ab1988610d7a08b4e9c83ec432342c4f8a208954965897c63eafe61e4f66a76c2c12475954ccb2c8bea3844fb4566ab19cb7c015df20b5204b0184133ef42c231f8b9569452d2179ab6fc91855d698b72b419f27c688225dd8d62e9b787924d1a3d3c6b81b044b3d68b903880db8c70b860116547b3963156b08f054e50b97c1f2bd04a996025189b03b25fa5803208c41e1b1a5dff22f0934c59685453dd38ca42941538c83742c52f0e8407ad2020dc9ccab052e004172ff0bb0db4117c1f3a54311ceda28be8bfac05e308040f5a4388885e7e426781cacb81b0d8de866e0e6a68a27837910a5e0483af7489761d35604b766f9f1b8fd9b59e4ac1a59840f776a93342aca79733de9b9bf7e86550f21a07545c978c22b125ccb7e1a8ff18890b2195b3c563dd7033385e7af50d97eadb65b15408d82269dcd8022324b9c134c7cdf124eb29a6bf1d238f4b2405cb94dca8b8e59937262aabc1b30505fa539910644cfd3cb31b0b88dcbcf4703be00f797ce6332bdf7c960166930031bc8fc9d1761c557d298a458029d5844b9023d6796a17957ba87f19730a84f689970ab017da73a48dfd5ca61e2a69a8641304355ccf58295ca074680977685b909ac79fcb9851b273f8511739c5158d13a2bf212aab327a088115a15343533787cec66c53e214dc449ab59dc26e09bc10d560a8b48248b80c08cf4400bb35b11e37faff01183098f25080df0d65a4499b87d5884ad49bc77d323c76bbbfe03113ce37c595002d62c50cea51f43717faf514a2dc95d20055ae0ea1c4ca71ec9762e1c8c6efb1acf6d792897429ad97b8577893fd961c2f4d28162e0888f3633be1c0dca63989c83b6d6730bd40b85a1a754d245ae20857ba07b91a914058c5a51e886a75b359111913b657143cc5c80f04b77ec6257c9f83f17a58748f0052e254c64545653eb9a6facb2d7b09046b1b86e596933721b0d167d9b47487cda85a9d04d635cbfeb0b242cac270d5399cb8415bb313458522f3b07b9e1c5963d096afad58aaa281ffb2539aa972514d9740573112bea20b9969e74911d5675264c9a3e49bc6f311803d6151b1f269a6a34839601c22878cad682500895231eb3a0a8c6380f343e1e6073598c32691b5d03b70a8c19a8666874bd2a6e1b29c2cf975a7c2615f279a6f944c6da486315d510f459730d74a5fde638de382a4712cb28cc7b2a34ca8ff6768faa324a98b43c6b70bafa560db91cd1076d4a492c57954dd3bb9a78616b3f1bce68202bec503408ab24d1f42612003a9374b16beb14ebe9a5388401e8f5890ae02fa2a67fe5772eedb6b4a4787b29c846e66c869d98294bd1335892734acc6b918f67f1b60dfab658c9a0cd24700b68750f5d16adce481de24689189af7ce0a557b98342825de00f12f2732faa0eb4727a2f00c70dbea19afa347992d001d0020f7ce0a557b98342825de00f12f2732faa0eb4727a2f00c70dbea19af","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d","f20f35624b79af10f537cb4e1e40197e"],"http_akin":["b11cun040_00040013_608dab68","b11cun030_00040012_13ee3d34","b10lun000_00000000_334359b9","b11cuq050_00040813_2619b3ac"]},"fingerprint_peers":{"t13i2511h2_b78ed14e2fd0_ab7e3b40a677":93,"t13i311000_e8f1e7e78f70_d41ae481755e":794,"b11cun040_00040013_608dab68":4305,"b11cun030_00040012_13ee3d34":5072,"b10lun000_00000000_334359b9":2216,"b11cuq050_00040813_2619b3ac":21},"akin_families":{"b11cun040_00040013_608dab68":{"head":"b11cun040_00040013_608dab68","shapes":2,"ips":4305},"b10lun000_00000000_334359b9":{"head":"b10lun000_00000000_334359b9","shapes":2,"ips":2216},"b11cuq050_00040813_2619b3ac":{"head":"b11cuq050_00040813_2619b3ac","shapes":2,"ips":21}},"user_agents":["python-urllib3/2.7.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36"],"timeline":[{"date":"2026-08-31","count":1},{"date":"2026-09-12","count":46},{"date":"2026-09-27","count":3}],"recent_events":[{"timestamp":"2026-09-27T12:52:41","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"","session":"14e1f848-2f65-4e27-b855-eeba5cb391f2","seq":1,"duration_ms":100,"bytes_in":220,"bytes_out":80},{"timestamp":"2026-09-27T12:52:41","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_layouts/15/error.aspx","summary":"","payload_hex":"474554202f5f6c61796f7574732f31352f6572726f722e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"","session":"deb44589-a5e9-47cb-b333-b894a0947953","seq":1,"duration_ms":100,"bytes_in":242,"bytes_out":80},{"timestamp":"2026-09-27T12:51:22","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"0\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/wsman","summary":"","payload_hex":"504f5354202f77736d616e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a436f6e74656e742d4c656e6774683a20300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"POST","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"d1502d30-af06-48c2-b42c-f0305046285b","seq":1,"duration_ms":100,"bytes_in":241,"bytes_out":80},{"timestamp":"2026-09-12T03:19:08","port":2048,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001I20100\n","payload_hex":"014932303130300a","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"6019b5d1-1c95-4b84-a75b-836598b134f5","seq":1,"duration_ms":120,"bytes_in":8,"bytes_out":15,"enriched":{"digest":"14b0bf5196552d7e","strings":["I20100"]}},{"timestamp":"2026-09-12T03:19:06","port":2048,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"c178b8d0-7606-464c-8d88-a8a400c890ec","seq":1,"duration_ms":121,"bytes_in":5,"bytes_out":15},{"timestamp":"2026-09-12T03:19:05","port":2048,"proto":"tcp","app_proto":"tls","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d41646d696e6973747261746f720d0a0100080000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"4d3400cc-b2ad-4b23-8ae3-564eea41214c","seq":1,"duration_ms":121,"bytes_in":51,"bytes_out":15,"enriched":{"digest":"56a8af4f4fb4faa0","label":"RDP (X.224)","strings":["Cookie: mstshash=Administrator"]}},{"timestamp":"2026-09-12T03:19:03","port":2048,"proto":"tcp","app_proto":"tls","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000FINDSCU\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000:Q\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\u001e1.2.826.0.1.3680043.2.1396.999U\u0000\u0000\fCharruaVista","payload_hex":"0100000000cd00010000414e592d53435000000000000000000046494e44534355000000000000000000000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100000030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000003a51000004000040005200001e312e322e3832362e302e312e333638303034332e322e313339362e3939395500000c436861727275615669737461","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"8d187a77-1ba8-4b3a-9732-329c9223a940","seq":1,"duration_ms":120,"bytes_in":211,"bytes_out":15,"enriched":{"digest":"14f9c94d13e59316","label":"DICOM","strings":["ANY-SCP","FINDSCU","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.826.0.1.3680043.2.1396.999U","CharruaVista","ANY-SCPFINDSCU","1.2.840.10008.3.1.1.1 .","1.2.840.10008.1.2P:Q"]}},{"timestamp":"2026-09-12T03:19:01","port":2048,"proto":"tcp","app_proto":"tls","app_protocol":"iscsi","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003�\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000AuthMethod=None\u0000\u0000","payload_hex":"038100000000005f40000137000000000000000100010000000000010000000100000000000000000000000000000000496e69746961746f724e616d653d69716e2e313939312d30352e636f6d2e6d6963726f736f66743a6265696f2d69736373692d70726f62650053657373696f6e547970653d446973636f7665727900417574684d6574686f643d4e6f6e650000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"c370fb78-c2c4-4501-8519-0b0c563e2c13","seq":1,"duration_ms":120,"bytes_in":144,"bytes_out":15,"enriched":{"digest":"482810f8d0264f72","label":"iSCSI","strings":["InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe","SessionType=Discovery","AuthMethod=None","InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probeSessionType=DiscoveryAut…"],"iocs":{"domains":["iqn.1991-05.com.microsoft"]}}},{"timestamp":"2026-09-12T03:19:00","port":2048,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000","payload_hex":"000000010000000100000004000000080000000100000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"3468e5cf-9545-4d86-a69e-adb379b978e7","seq":1,"duration_ms":120,"bytes_in":24,"bytes_out":15},{"timestamp":"2026-09-12T03:18:58","port":2048,"proto":"tcp","app_proto":"tls","app_protocol":"pptp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000�\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001��\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000beio\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"009c00011a2b3c4d00010000010000000000000100000001ffff00016e6f6e650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006265696f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"7cc793c5-9351-41c0-b06e-c510353b2714","seq":1,"duration_ms":119,"bytes_in":156,"bytes_out":15,"enriched":{"digest":"3415c4d31123c5ba","strings":["none","beio","nonebeio"]}}],"http_methods":[{"method":"GET","count":6},{"method":"OPTIONS","count":2},{"method":"POST","count":1}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":5,"ports":2},{"path":"/wsman","count":1,"ports":1},{"path":"/_layouts/15/error.aspx","count":1,"ports":1},{"path":"/query?q=show+databases%3Bshow+diagnostics+for+%27runtime%27%3Bshow+diagnostics+for+%27network%27%3Bshow+stats+for+%27shard%27%3Bshow+stats+for+%27runtime%27%3Bshow+users%3Bshow+diagnostics+for+%27system%27","count":1,"ports":1},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":1,"ports":1}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":1}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Content-Length","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"0","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":3},"tags":[],"data_as_of":"2026-09-30T15:30:39.294682+00:00"}