{"ip":"134.209.52.13","total_events":49,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"binaryedge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (binaryedge).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,430 bytes sent","bytes_sent":5430,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-27T14:05:00","last_seen":"2026-09-26T03:11:29","events_24h":0,"events_7d":3,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Santa Clara","lat":37.3486,"lon":-121.9732,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"sfo2-25.boron.do.prod.binaryedge.ninja","known_scanners":["binaryedge","BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[{"cve_id":"CVE-2025-0282","title":"Ivanti Connect Secure - Stack-based Buffer Overflow","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/dana-na/auth/url_default/welcome.cgi"}],"malware":[],"top_ports":[{"port":264,"proto":"tcp","label":"","count":46},{"port":443,"proto":"tcp","label":"HTTPS","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i2511h2_b78ed14e2fd0_ab7e3b40a677","t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"16030105f4010005f003038e092bac0e8da2ed2706a0a1ff5015f5c2c279ffda668e68f82ab4d2a79b4577204fb9aeee9ad8060a2c75bba05813b59fc4d8f186eb96db57cf40c4d943d703c30032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000575000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a00180804040308070805080604010501060105030603020102030010000e000c02683208687474702f312e31002b0009080304030303020301003304ea04e811ec04c0067c9812d34ed36729ef49ad794c9816a3cd923723eed8c53625bef6b10a355756c2e9739220c03d3c8486e518557c6bb9b59cafb8ba2a672d03aa6c6a929b918535e9d193b2f1b4ce55cbb1e87f966818ee75a885a994a1f30359ec209a33322bb49c9a3aa79df0ad882c3a847c471d4a33aee303b06b70c50accec7927df1560f09b3d1347911f71048a99ad39b665f3e47e9e69ab95ba8a27b2b70957c4b7830942eb5965c6272ff91a1b8a6b56a1189156b291c80156748cd16c025fc583d2e176a975bce1a1a37fd3257b7079b6e23d73a266be35cc055969c7852a948079317252be248888383e1c179cd338615ad222e6ec483b493d18136173500a07461a21f4c5efa55dab21913af003a68817875330e8000f31d3b706d912b473b2acd4256e38ca18db8cda165b4621c9b434b7cd593864965e850892606880888b017054556329899dc2a59acc690b5c64abbbcc29388f89f3307b5132b9a5438b4a4a26a35e3ee936921493ee9ba94de3a97661abaf8a7c470742b618140bf11de5430b26d61bd3d67c1065cb4c9ac7ddc7071327b4b6a617153035ca92bd725a377c8bc3d78b7919c4604b566179473d67234424a28761a345129ca1beab0fa95a8af81627ab871c6b857886d4085e019a0391c149ab698fb60d42a830a4d531c874b1e50b750f56ca219ab846f691cef0b4ed1638aa2993fcf4831c74019eba6878a793c0d32a1c489972d35412678606e3a7e7a44f803c69c5657656a06aa8159550e6cade34b963c17c55005386c124b86c6bd6885f0b323e9b66a8bfe40cba7c08258338e9637cdc2486a5e12f56fb0de88c47a451317a76a9b41611ec4b094bf3c569702cf56ca20af4b1c806b216cb3e06f31c5089766ef37edc4aa04446006fe2ce76172f7d70989bf31cc49ab6773170ba47721dd91dcfdc925c95005062531c486544991abd566c19133b6bb707f67c4beeacb05c9cb8c11912d7cb822fe2a358daa976028657214b82d3634fb70f935022a535631d31a311400825ec1494d73db61c07562c1138f618afd719e660658d18cd40952111364cbf848c33667812140e140b5cee9c919638752b1329d593457c63182e8b0174975ff56ba34c3247f70424844a697dfc9d0e15a485b2c12d8c3b17b813517ba9d1301b572a4c49974114daa528975db77bad8b087c2c354a28a99e00a4297adbc11657438ff9308aec90a9d43c66dacb939b5dd051881ee64cfb0b7545a49eef345d1634be993034cde785e8987074726eacd04189d62086d1ce25082f70c7c49a60546d840add21b0f219ad9c23af06f9760f86a79fe74fc0091566c93f0d9704af9270739c037bb1b563d3af3a3ba51eb21e126310368a4bb2571828485f534208db27b02402c9f4e72588ac566d96c29f86b5f1136e2e256a234608aec8ac6d3681d4026567a75756458681918c1403576417439fb46c1442289f0700d48551e6c12d43e97afee584bf46c89c04002a062d5a11049601428d44a50388ad90413e1a2a89caf50c8af1a7bd8970f19cb9ffd21360e31b837388b969a125556237969283bbcd19592010cbc5e1a26479a1c990492ccf82a211a626e09971c4f695f350ca987ebfbfa8cf3861457f5494b25bb2e2e8de4331c31e2de602d2685e61cd10778ab3b7ccf599bd5e83c5a5956a834587b32f25a687926963d476d25b17dcbc39001d00208ab3b7ccf599bd5e83c5a5956a834587b32f25a687926963d476d25b","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d","f20f35624b79af10f537cb4e1e40197e"],"http_akin":["a11cun040_0000004e_608dab68"]},"fingerprint_peers":{"t13i2511h2_b78ed14e2fd0_ab7e3b40a677":93,"t13i311000_e8f1e7e78f70_d41ae481755e":807,"a11cun040_0000004e_608dab68":814},"akin_families":{"a11cun040_0000004e_608dab68":{"head":"a11cun040_0000004e_608dab68","shapes":2,"ips":816}},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36"],"timeline":[{"date":"2026-08-27","count":46},{"date":"2026-09-26","count":3}],"recent_events":[{"timestamp":"2026-09-26T03:11:29","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dana-cached/hc/HostCheckerInstaller.osx","summary":"","payload_hex":"474554202f64616e612d6361636865642f68632f486f7374436865636b6572496e7374616c6c65722e6f737820485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"0da16142-fff9-4bb9-828f-b8d806a654c8","seq":1,"duration_ms":101,"bytes_in":255,"bytes_out":78},{"timestamp":"2026-09-26T03:11:29","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dana-na/auth/url_default/welcome.cgi","summary":"","payload_hex":"474554202f64616e612d6e612f617574682f75726c5f64656661756c742f77656c636f6d652e63676920485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"96783835-6c66-4057-8f5a-2acaed17ccee","seq":1,"duration_ms":101,"bytes_in":252,"bytes_out":78},{"timestamp":"2026-09-26T03:11:28","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dana-na/nc/nc_gina_ver.txt","summary":"","payload_hex":"474554202f64616e612d6e612f6e632f6e635f67696e615f7665722e74787420485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"4200f6f0-593e-49be-87dc-ad779a175fd3","seq":1,"duration_ms":101,"bytes_in":242,"bytes_out":78},{"timestamp":"2026-08-27T14:06:39","port":264,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001I20100\n","payload_hex":"014932303130300a","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"1a0edf0b-8e64-42fc-8cf0-4802cda60380","seq":1,"duration_ms":247,"bytes_in":8,"bytes_out":13,"enriched":{"digest":"14b0bf5196552d7e","strings":["I20100"]}},{"timestamp":"2026-08-27T14:06:36","port":264,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"7806afb3-7e14-4cf4-8b50-48c9a745c40a","seq":1,"duration_ms":248,"bytes_in":5,"bytes_out":13},{"timestamp":"2026-08-27T14:06:34","port":264,"proto":"tcp","app_proto":"tls","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d41646d696e6973747261746f720d0a0100080000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"20542d4e-23fe-496b-a3ec-a44e1c8527d8","seq":1,"duration_ms":246,"bytes_in":51,"bytes_out":13,"enriched":{"digest":"56a8af4f4fb4faa0","label":"RDP (X.224)","strings":["Cookie: mstshash=Administrator"]}},{"timestamp":"2026-08-27T14:06:32","port":264,"proto":"tcp","app_proto":"tls","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000FINDSCU\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000:Q\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\u001e1.2.826.0.1.3680043.2.1396.999U\u0000\u0000\fCharruaVista","payload_hex":"0100000000cd00010000414e592d53435000000000000000000046494e44534355000000000000000000000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100000030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000003a51000004000040005200001e312e322e3832362e302e312e333638303034332e322e313339362e3939395500000c436861727275615669737461","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"8bc96c2a-d652-4ef9-adac-7c07aba190f8","seq":1,"duration_ms":246,"bytes_in":211,"bytes_out":13,"enriched":{"digest":"14f9c94d13e59316","label":"DICOM","strings":["ANY-SCP","FINDSCU","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.826.0.1.3680043.2.1396.999U","CharruaVista","ANY-SCPFINDSCU","1.2.840.10008.3.1.1.1 .","1.2.840.10008.1.2P:Q"]}},{"timestamp":"2026-08-27T14:06:30","port":264,"proto":"tcp","app_proto":"tls","app_protocol":"iscsi","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003�\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000AuthMethod=None\u0000\u0000","payload_hex":"038100000000005f40000137000000000000000100010000000000010000000100000000000000000000000000000000496e69746961746f724e616d653d69716e2e313939312d30352e636f6d2e6d6963726f736f66743a6265696f2d69736373692d70726f62650053657373696f6e547970653d446973636f7665727900417574684d6574686f643d4e6f6e650000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"fb4a2b9e-b30a-4406-bed7-7af620d0226d","seq":1,"duration_ms":243,"bytes_in":144,"bytes_out":13,"enriched":{"digest":"482810f8d0264f72","label":"iSCSI","strings":["InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe","SessionType=Discovery","AuthMethod=None","InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probeSessionType=DiscoveryAut…"],"iocs":{"domains":["iqn.1991-05.com.microsoft"]}}},{"timestamp":"2026-08-27T14:06:28","port":264,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000","payload_hex":"000000010000000100000004000000080000000100000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"a9f0d6b1-579a-4930-86e8-8ca5253ed6cb","seq":1,"duration_ms":243,"bytes_in":24,"bytes_out":13},{"timestamp":"2026-08-27T14:06:25","port":264,"proto":"tcp","app_proto":"tls","app_protocol":"pptp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000�\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001��\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000beio\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"009c00011a2b3c4d00010000010000000000000100000001ffff00016e6f6e650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006265696f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"fccaf5bd-048f-40d1-9335-075dc8e05708","seq":1,"duration_ms":246,"bytes_in":156,"bytes_out":13,"enriched":{"digest":"3415c4d31123c5ba","strings":["none","beio","nonebeio"]}}],"http_methods":[{"method":"GET","count":6},{"method":"OPTIONS","count":2}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":4,"ports":1},{"path":"/dana-na/nc/nc_gina_ver.txt","count":1,"ports":1},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":1,"ports":1},{"path":"/dana-na/auth/url_default/welcome.cgi","count":1,"ports":1},{"path":"/dana-cached/hc/HostCheckerInstaller.osx","count":1,"ports":1}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":3}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[{"tag_id":"CVE-2025-0282","tag_type":"cve","title":"Ivanti Connect Secure - Stack-based Buffer Overflow","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/dana-na/auth/url_default/welcome.cgi","reference_urls":["https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283","https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/","https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","https://nvd.nist.gov/vuln/detail/CVE-2025-0282"]}],"data_as_of":"2026-09-29T15:42:09.076991+00:00"}