{"ip":"139.177.205.25","total_events":235,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"binaryedge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (binaryedge).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"22,436 bytes sent","bytes_sent":22436,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-16T11:05:16","last_seen":"2026-09-16T04:25:30","events_24h":0,"events_7d":3,"geo":{"country_code":"US","country_name":"United States","region":"Georgia","city":"Atlanta","lat":33.7485,"lon":-84.3871,"asn":63949,"org":"Akamai Connected Cloud"},"source_domain":"us-southeast-12.barium.li.prod.binaryedge.ninja","known_scanners":["binaryedge","BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":84,"proto":"tcp","label":"","count":47},{"port":8585,"proto":"tcp","label":"","count":46},{"port":9295,"proto":"tcp","label":"","count":46},{"port":5900,"proto":"tcp","label":"VNC","count":46},{"port":7415,"proto":"tcp","label":"","count":12},{"port":3360,"proto":"tcp","label":"","count":12},{"port":47001,"proto":"tcp","label":"","count":11},{"port":143,"proto":"tcp","label":"IMAP","count":6},{"port":3319,"proto":"tcp","label":"","count":3},{"port":3381,"proto":"tcp","label":"","count":3},{"port":51749,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":913},"user_agents":[],"timeline":[{"date":"2026-07-16","count":3},{"date":"2026-07-22","count":12},{"date":"2026-08-08","count":46},{"date":"2026-08-21","count":6},{"date":"2026-08-24","count":46},{"date":"2026-08-26","count":93},{"date":"2026-08-31","count":12},{"date":"2026-09-01","count":3},{"date":"2026-09-02","count":11},{"date":"2026-09-16","count":3}],"recent_events":[{"timestamp":"2026-09-16T04:25:30","port":51749,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080000000000","method":"","user_agent":"","ja3":"","session":"fbfafb70-6d8b-445b-b43f-2a692cac0569","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"b481beafe15f409a","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-16T04:25:30","port":51749,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"c3b2464d-c00f-48f4-9105-602e4952f4d6","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-16T04:25:30","port":51749,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"e5bc76ea-d427-4880-a941-fb4453b70206","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-02T14:04:01","port":47001,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"57cc6631-04d1-4924-9ad2-0fe62e78811e","seq":1,"duration_ms":203,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-09-02T14:03:59","port":47001,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"JRMI\u0000\u0002K","payload_hex":"4a524d4900024b","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"73ad62b0-7f79-4954-9197-875014dc3d1f","seq":1,"duration_ms":204,"bytes_in":7,"bytes_out":14,"enriched":{"digest":"520dae2bdcec9072","strings":["JRMI"]}},{"timestamp":"2026-09-02T14:03:55","port":47001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"HELP\r\n","payload_hex":"48454c500d0a","method":"","user_agent":"","ja3":"","session":"5b384dc1-ddee-426b-ac1d-38f29616476c","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":14,"enriched":{"digest":"d6616dd899abc961","strings":["HELP"]}},{"timestamp":"2026-09-02T14:03:53","port":47001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\f\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"000c000010000000000000000000","method":"","user_agent":"","ja3":"","session":"2360da48-1696-4fbf-a800-3070a891a03d","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":14},{"timestamp":"2026-09-02T14:03:51","port":47001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u001e\u0000\u0006\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007version\u0004bind\u0000\u0000\u0010\u0000\u0003","payload_hex":"001e0006010000010000000000000776657273696f6e0462696e640000100003","method":"","user_agent":"","ja3":"","session":"ee0900e6-5607-42c4-bd36-6174e1b242ae","seq":1,"duration_ms":100,"bytes_in":32,"bytes_out":14,"enriched":{"digest":"75f479f7d331db45","strings":["version","bind"]}},{"timestamp":"2026-09-02T14:03:49","port":47001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(r�\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0001�|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002872fe1d130000000000000002000186a00001977c0000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"64b0cf1a-d1df-42ba-9013-3df5696b1985","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":14},{"timestamp":"2026-09-02T14:03:47","port":47001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS / RTSP/1.0\r\n\r\n","payload_hex":"4f5054494f4e53202f20525453502f312e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"4a3d4e40-a58c-40d1-85f1-7e94ba612bc4","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":79,"enriched":{"digest":"b6bc3f9a3eb2980d","label":"HTTP","strings":["OPTIONS / RTSP/1.0"]}}],"http_methods":[{"method":"GET","count":19},{"method":"OPTIONS","count":9}],"distinct_ports_total":11,"top_paths":[{"path":"/","count":23,"ports":8},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":5,"ports":4}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-22T03:34:05.688178+00:00"}