{"ip":"137.184.30.153","total_events":85,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"binaryedge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (binaryedge).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"9,442 bytes sent","bytes_sent":9442,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-28T06:40:06","last_seen":"2026-09-27T22:22:41","events_24h":0,"events_7d":1,"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"North Bergen","lat":40.7964,"lon":-74.0203,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"nyc1-112.boron.do.prod.binaryedge.ninja","known_scanners":["binaryedge","BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":21000,"proto":"tcp","label":"","count":46},{"port":992,"proto":"tcp","label":"","count":38},{"port":443,"proto":"tcp","label":"HTTPS","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i2511h2_b78ed14e2fd0_ab7e3b40a677","t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"16030105f4010005f0030389daf79441c06078fcf1ab2175849b946fd2d5e578fc0ffab58c0657858f552f20e0716b8ec5517aa0cc04c2a63e9661c89f18d10aa4dfde4ecc998f42673eb9920032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000575000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a00180804040308070805080604010501060105030603020102030010000e000c02683208687474702f312e31002b0009080304030303020301003304ea04e811ec04c08900cebc08b7e4897f7ff158e3b5cc5d182b9d8098795c5654b178f4c77bcbc58b32c5853d3c9635b772f16bae3ae2494a7c8c283c6970c120d9aa4589c62d900963be33b17f701d0521cdc1677e0b49a2ad3346422a1c034c10dec00d0f321442a53d27a4ba3f982d54e12b8533a8af44193442cc28b63bc5c164ee472f560b0eff91aeeb96618b1b603bf306bda781bf750439447c7ef7509fb66fe32076ae7c62b765103090312b81a2e2f659b2a3451b08c92c965804124e06c16dcc9816a32269cf233e37433f17c793f6187f38a99226bbb8382970b66500cf2746532b36e5581f29b6b1f14c97ca9600c4391806e22e49a32ba62489731589c3e39e485c2e836b2a4d9b339202a96340aa4e2c31441580e58250cf02b6e7e5abe4aa8832795f28c54629b70b58cc2681904e7887adf480a75d7932b662a75135be25c675f739988ebaa5177b84d599ca3770a2f06a24e97744fa72748b13c6ab92652492a959230b055bc000f50cb357065b754c04761a5a1b2855f020a3642ed6d529e5e248d386b2a651886f8c4807448b8fe06444d0cf7a8a6a6f9c4c092a942824059691a11346ce47c284563b964d847fa555467e967158a71817e1a6570106a9024d1913c3db2a7a15817edf031b7dcabc63db2d1c495a02cc6a2f61baff4c6697b304a3b0be4bf5b0f72967e30504553c36b205bffe2c999fc080df37075e6062e74b5388f620e625546d53c0c586c6329982f2051a7138892ba61cbd84b526447c703a5700c72f08acba35ec32b7b3578d3a1381240d2b1a3b20bb1932585b35438a1b3a2053d14ab1f8780e877d3b2467180154412b5c5a3a1debb9440e1a24d9d5c17cec829f68320faca253261106d1092bf8bcf5b74c1f5984eba0ca4cc75e5a633e59e147c402b25b355b3753031ef4234be81f7ce7907ec711461b74fec833d8bbbaad0553fdca9440e1a37ca3a9c7f54196391d4cc17973e19fc2d191740c91a21ba2531065210a2d0b33919546786531aa313393dc3a0d83440bc8c0b3e20227e8446cbc6396e267914e121ba4f684d402ca9d8c333d672dce89029009299f7446e94576531a5ed2d682ba69bd332b5e04cb4bf1323c11430c001cbd36c51e8a0496d0d49665e3157a09b9d15080c3fb5706488d7ed9422b2771253608abcb8452d14a6f73514b5bb466aa5af4e152048184fc12373ba1c92d0c683b536058ea7184b830d479047f6827ecaa4942721180683f43e075a2d0adece4c98b8b90d4938abf45698ea4b8dc4227b45a2bdad3bd543cbdedd92ce6f159b439ca8e464abf7a8b326406a87b6994916da510a92d107d06758dc05943c7475915940183790d9c5c56c7220553e33d73fa2c0d769d1bc1bb2d4cb45c9922c8930b1b3317bb2521f2910806e0236669857f00927ac348cfec212d84293f6641d8b335d395ba64a2770f100f519c1006dc1aeef790a6e13baae8184dd609e300a96f28b2ecf38b59a67f404c8845a13b46c61331bc42c15c3e2479257d617aec263d14d63e6f7bae7e160a856a6307d394ff6c0707295f21d77aca547f0da503902c4548d06308d8039128bf7df300c73547ee529df75a15a81a780ec08950c9c08c2788746a6a7c9a32f29006fdc2b66df8bd6de1d61c929df3afda412b4cba0eccbc706b8dccb4cd429c130299803ebbd2ceadab92b3b583b50b1b27b8608a10001d0020ccbc706b8dccb4cd429c130299803ebbd2ceadab92b3b583b50b1b27","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d","f20f35624b79af10f537cb4e1e40197e"],"http_akin":["b10lun000_00000000_334359b9","b11cuq050_00040813_2619b3ac"]},"fingerprint_peers":{"t13i2511h2_b78ed14e2fd0_ab7e3b40a677":93,"t13i311000_e8f1e7e78f70_d41ae481755e":793,"b10lun000_00000000_334359b9":2219,"b11cuq050_00040813_2619b3ac":21},"akin_families":{"b10lun000_00000000_334359b9":{"head":"b10lun000_00000000_334359b9","shapes":2,"ips":2219},"b11cuq050_00040813_2619b3ac":{"head":"b11cuq050_00040813_2619b3ac","shapes":2,"ips":21}},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36"],"timeline":[{"date":"2026-08-28","count":38},{"date":"2026-09-02","count":46},{"date":"2026-09-27","count":1}],"recent_events":[{"timestamp":"2026-09-27T22:22:41","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"0\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/wsman","summary":"","payload_hex":"504f5354202f77736d616e20485454502f312e310d0a486f73743a200d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a436f6e74656e742d4c656e6774683a20300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"POST","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"600063dc-20b8-4578-9d8f-ef453b5431ea","seq":1,"duration_ms":105,"bytes_in":242,"bytes_out":79},{"timestamp":"2026-09-02T07:27:32","port":21000,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001I20100\n","payload_hex":"014932303130300a","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"a16a2460-b17b-45d0-95f2-8a925602fb7b","seq":1,"duration_ms":189,"bytes_in":8,"bytes_out":14,"enriched":{"digest":"14b0bf5196552d7e","strings":["I20100"]}},{"timestamp":"2026-09-02T07:27:30","port":21000,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"15e8085e-8711-468c-8b42-579db85b7c5b","seq":1,"duration_ms":190,"bytes_in":5,"bytes_out":14},{"timestamp":"2026-09-02T07:27:28","port":21000,"proto":"tcp","app_proto":"tls","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d41646d696e6973747261746f720d0a0100080000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"d095521f-fd00-43be-82cd-27c76998ee8f","seq":1,"duration_ms":189,"bytes_in":51,"bytes_out":14,"enriched":{"digest":"56a8af4f4fb4faa0","label":"RDP (X.224)","strings":["Cookie: mstshash=Administrator"]}},{"timestamp":"2026-09-02T07:27:26","port":21000,"proto":"tcp","app_proto":"tls","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000FINDSCU\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000:Q\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\u001e1.2.826.0.1.3680043.2.1396.999U\u0000\u0000\fCharruaVista","payload_hex":"0100000000cd00010000414e592d53435000000000000000000046494e44534355000000000000000000000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100000030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000003a51000004000040005200001e312e322e3832362e302e312e333638303034332e322e313339362e3939395500000c436861727275615669737461","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"fa828e50-0559-4f03-a24b-1bd3ae0b7dad","seq":1,"duration_ms":189,"bytes_in":211,"bytes_out":14,"enriched":{"digest":"14f9c94d13e59316","label":"DICOM","strings":["ANY-SCP","FINDSCU","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.826.0.1.3680043.2.1396.999U","CharruaVista","ANY-SCPFINDSCU","1.2.840.10008.3.1.1.1 .","1.2.840.10008.1.2P:Q"]}},{"timestamp":"2026-09-02T07:27:24","port":21000,"proto":"tcp","app_proto":"tls","app_protocol":"iscsi","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003�\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000AuthMethod=None\u0000\u0000","payload_hex":"038100000000005f40000137000000000000000100010000000000010000000100000000000000000000000000000000496e69746961746f724e616d653d69716e2e313939312d30352e636f6d2e6d6963726f736f66743a6265696f2d69736373692d70726f62650053657373696f6e547970653d446973636f7665727900417574684d6574686f643d4e6f6e650000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"6107dabc-7ba1-4d19-8b03-854e470db6d2","seq":1,"duration_ms":189,"bytes_in":144,"bytes_out":14,"enriched":{"digest":"482810f8d0264f72","label":"iSCSI","strings":["InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe","SessionType=Discovery","AuthMethod=None","InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probeSessionType=DiscoveryAut…"],"iocs":{"domains":["iqn.1991-05.com.microsoft"]}}},{"timestamp":"2026-09-02T07:27:22","port":21000,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000","payload_hex":"000000010000000100000004000000080000000100000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"137ad695-c6fd-4cd4-a6e6-fd73f4f99396","seq":1,"duration_ms":189,"bytes_in":24,"bytes_out":14},{"timestamp":"2026-09-02T07:27:20","port":21000,"proto":"tcp","app_proto":"tls","app_protocol":"pptp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000�\u0000\u0001\u001a+\u0000\r\u0000\n\u0000<\u0000s\u0000e\u0000:\u0000H\u0000e\u0000a\u0000d\u0000e\u0000r\u0000>\u0000\r\u0000\n\u0000 \u0000<\u0000p\u0000a\u0000t\u0000h\u0000 \u0000x\u0000m\u0000l\u0000n\u0000s\u0000=\u0000\"\u0000h\u0000t\u0000t\u0000p\u0000:\u0000/\u0000/\u0000s\u0000c\u0000h\u0000e\u0000m\u0000a\u0000s\u0000.\u0000x\u0000m\u0000l\u0000s\u0000o\u0000a\u0000p\u0000.\u0000o\u0000r\u0000g\u0000/\u0000r\u0000p\u0000/\u0000\"\u0000 \u0000s\u0000e\u0000:\u0000m\u0000u\u0000s\u0000t\u0000U\u0000n\u0000d\u0000e\u0000r\u0000s\u0000t\u0000a\u0000n\u0000d\u0000=\u0000\"\u00001\u0000\"\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000<\u0000a\u0000c\u0000t\u0000i\u0000o\u0000n\u0000>\u0000M\u0000S\u0000M\u0000Q\u0000:\u0000p\u0000o\u0000c\u0000<\u0000/\u0000a\u0000c\u0000t\u0000i\u0000o\u0000n\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000<\u0000t\u0000o\u0000>\u0000h\u0000t\u0000t\u0000p\u0000:\u0000/\u0000/\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00001\u00000\u0000.\u00001\u00000\u00000\u0000/\u0000m\u0000s\u0000m\u0000q\u0000/\u0000p\u0000r\u0000i\u0000v\u0000a\u0000t\u0000e\u0000$\u0000/\u0000q\u0000u\u0000e\u0000u\u0000e\u0000j\u0000u\u0000m\u0000p\u0000e\u0000r\u0000<\u0000/\u0000t\u0000o\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000<\u0000i\u0000d\u0000>\u0000u\u0000u\u0000i\u0000d\u0000:\u00001\u0000@\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u0000<\u0000/\u0000i\u0000d\u0000>\u0000\r\u0000\n\u0000 \u0000<\u0000/\u0000p\u0000a\u0000t\u0000h\u0000>\u0000\r\u0000\n\u0000 \u0000<\u0000p\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000i\u0000e\u0000s\u0000 \u0000s\u0000e\u0000:\u0000m\u0000u\u0000s\u0000t\u0000U\u0000n\u0000d\u0000e\u0000r\u0000s\u0000t\u0000a\u0000n\u0000d\u0000=\u0000\"\u00001\u0000\"\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000<\u0000e\u0000x\u0000p\u0000i\u0000r\u0000e\u0000s\u0000A\u0000t\u0000>\u00002\u00000\u00006\u00000\u00000\u00006\u00000\u00009\u0000T\u00001\u00006\u00004\u00004\u00001\u00009\u0000<\u0000/\u0000e\u0000x\u0000p\u0000i\u0000r\u0000e\u0000s\u0000A\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000<\u0000s\u0000e\u0000n\u0000t\u0000A\u0000t\u0000>\u00002\u00000\u00002\u00003\u00000\u00007\u00002\u00004\u0000T\u00001\u00006\u00004\u00004\u00001\u00009\u0000<\u0000/\u0000s\u0000e\u0000n\u0000t\u0000A\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000<\u0000/\u0000p\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000i\u0000e\u0000s\u0000>\u0000\r\u0000\n\u0000<\u0000/\u0000s\u0000e\u0000:\u0000H\u0000e\u0000a\u0000d\u0000e\u0000r\u0000>\u0000\r\u0000\n\u0000<\u0000s\u0000e\u0000:\u0000B\u0000o\u0000d\u0000y\u0000>\u0000<\u0000/\u0000s\u0000e\u0000:\u0000B\u0000o\u0000d\u0000y\u0000>\u0000\r\u0000\n\u0000<\u0000/\u0000s\u0000e\u0000:\u0000E\u0000n\u0000v\u0000e\u0000l\u0000o\u0000p\u0000e\u0000>\u0000\r\u0000\n\u0000\r\u0000\n\u0000\u0000\u0000\u0000\u0000�\u0001\u0000\u0000\f\u0004\u0000\u0000\u0007\u0000\u0000\u0000�\u0003\u0000\u0000POST /msmq HTTP/1.1\r\nContent-Length: 816\r\nContent-Type: multipart/related; boundary=\"MSMQ - SOAP boundary, 53287\"; type=text/xml\r\nHost: 192.168.10.100\r\nSOAPAction: \"MSMQMessage\"\r\nProxy-Accept: NonInteractiveClient\r\n\r\n--MSMQ - SOAP boundary, 53287\r\nContent-Type: text/xml; charset=UTF-8\r\nContent-Length: 606\r\n\r\n\r\n\r\n \r\n MSMQ:poc\r\n http://192.168.10.100/msmq/private$/queuejumper\r\n uuid:1@00000000-0000-0000-0000-000000000000\r\n \r\n \r\n 20600609T164419\r\n 20230724T164419\r\n \r\n\r\n\r\n\r\n\r\n--MSMQ - SOAP boundary, 53287\r\nContent-Type: application/octet-stream\r\nContent-Length: 7\r\nContent-Id: body@ff3af301-3196-497a-a918-72147c871a13\r\n\r\nMessage\r\n--MSMQ - SOAP boundary, 53287--\u0000\f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"100003004c494f524c090000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000063aabe6401000000011c2002600068007400740070003a002f002f003100390032002e003100360038002e00310030002e003100300030002f006d0073006d0071002f00700072006900760061007400650024002f00710075006500750065006a0075006d0070006500720000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070006f0063000000000000001b0200003c00730065003a0045006e00760065006c006f0070006500200078006d006c006e0073003a00730065003d00220068007400740070003a002f002f0073006300680065006d00610073002e0078006d006c0073006f00610070002e006f00720067002f0073006f00610070002f0065006e00760065006c006f00700065002f00220020000d000a0078006d006c006e0073003d00220068007400740070003a002f002f0073006300680065006d00610073002e0078006d006c0073006f00610070002e006f00720067002f00730072006d0070002f0022003e000d000a003c00730065003a004800650061006400650072003e000d000a0020003c007000610074006800200078006d006c006e0073003d00220068007400740070003a002f002f0073006300680065006d00610073002e0078006d006c0073006f00610070002e006f00720067002f00720070002f0022002000730065003a006d0075007300740055006e006400650072007300740061006e0064003d002200310022003e000d000a002000200020003c0061006300740069006f006e003e004d0053004d0051003a0070006f0063003c002f0061006300740069006f006e003e000d000a002000200020003c0074006f003e0068007400740070003a002f002f003100390032002e003100360038002e00310030002e003100300030002f006d0073006d0071002f00700072006900760061007400650024002f00710075006500750065006a0075006d007000650072003c002f0074006f003e000d000a002000200020003c00690064003e0075007500690064003a0031004000300030003000300030003000300030002d0030003000300030002d0030003000300030002d0030003000300030002d003000300030003000300030003000300030003000300030003c002f00690064003e000d000a0020003c002f0070006100740068003e000d000a0020003c00700072006f0070006500720074006900650073002000730065003a006d0075007300740055006e006400650072007300740061006e0064003d002200310022003e000d000a002000200020003c006500780070006900720065007300410074003e003200300036003000300036003000390054003100360034003400310039003c002f006500780070006900720065007300410074003e000d000a002000200020003c00730065006e007400410074003e003200300032003300300037003200340054003100360034003400310039003c002f00730065006e007400410074003e000d000a0020003c002f00700072006f0070006500720074006900650073003e000d000a003c002f00730065003a004800650061006400650072003e000d000a003c00730065003a0042006f00640079003e003c002f00730065003a0042006f00640079003e000d000a003c002f00730065003a0045006e00760065006c006f00700065003e000d000a000d000a0000000000f40100000c04000007000000e3030000504f5354202f6d736d7120485454502f312e310d0a436f6e74656e742d4c656e6774683a203831360d0a436f6e74656e742d547970653a206d756c7469706172742f72656c617465643b20626f756e646172793d224d534d51202d20534f415020626f756e646172792c203533323837223b20747970653d746578742f786d6c0d0a486f73743a203139322e3136382e31302e3130300d0a534f4150416374696f6e3a20224d534d514d657373616765220d0a50726f78792d4163636570743a204e6f6e496e746572616374697665436c69656e740d0a0d0a2d2d4d534d51202d20534f415020626f756e646172792c2035333238370d0a436f6e74656e742d547970653a20746578742f786d6c3b20636861727365743d5554462d380d0a436f6e74656e742d4c656e6774683a203630360d0a0d0a3c73653a456e76656c6f706520786d6c6e733a73653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f22200d0a786d6c6e733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f73726d702f223e0d0a3c73653a4865616465723e0d0a203c7061746820786d6c6e733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f72702f222073653a6d757374556e6465727374616e643d2231223e0d0a2020203c616374696f6e3e4d534d513a706f633c2f616374696f6e3e0d0a2020203c746f3e687474703a2f2f3139322e3136382e31302e3130302f6d736d712f70726976617465242f71756575656a756d7065723c2f746f3e0d0a2020203c69643e757569643a314030303030303030302d303030302d303030302d303030302d3030303030303030303030303c2f69643e0d0a203c2f706174683e0d0a203c70726f706572746965732073653a6d757374556e6465727374616e643d2231223e0d0a2020203c6578706972657341743e3230363030363039543136343431393c2f6578706972657341743e0d0a2020203c73656e7441743e3230323330373234543136343431393c2f73656e7441743e0d0a203c2f70726f706572746965733e0d0a3c2f73653a4865616465723e0d0a3c73653a426f64793e3c2f73653a426f64793e0d0a3c2f73653a456e76656c6f70653e0d0a0d0a2d2d4d534d51202d20534f415020626f756e646172792c2035333238370d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6f637465742d73747265616d0d0a436f6e74656e742d4c656e6774683a20370d0a436f6e74656e742d49643a20626f64794066663361663330312d333139362d343937612d613931382d3732313437633837316131330d0a0d0a4d6573736167650d0a2d2d4d534d51202d20534f415020626f756e646172792c2035333238372d2d000c0000000000000000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"d2332ad3-96e9-4945-8600-47d28258a0f9","seq":1,"duration_ms":189,"bytes_in":2380,"bytes_out":14,"enriched":{"digest":"45c6f72bb5aeb522","strings":["LIORL","POST /msmq HTTP/1.1","Content-Length: 816","Content-Type: multipart/related; boundary=\"MSMQ - SOAP boundary, 53287\"; type=te…","Host: 192.168.10.100","SOAPAction: \"MSMQMessage\"","Proxy-Accept: NonInteractiveClient","--MSMQ - SOAP boundary, 53287","Content-Type: text/xml; charset=UTF-8","Content-Length: 606"],"iocs":{"ips":["192.168.10.100"]}}},{"timestamp":"2026-09-02T07:27:16","port":21000,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u000e87�&\b�\u001b��\u0000\u0000\u0000\u0000\u0000","payload_hex":"000e3837a52608a21ba0b10000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"508273cf-b985-44e1-aee8-4f460d95fe37","seq":1,"duration_ms":189,"bytes_in":16,"bytes_out":14}],"http_methods":[{"method":"GET","count":5},{"method":"OPTIONS","count":3},{"method":"POST","count":1}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":6,"ports":2},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":2,"ports":2},{"path":"/wsman","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":1}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Content-Length","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"0","notable":false},{"name":"Host","value":"","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-30T19:10:19.015652+00:00"}