{"ip":"157.230.139.228","total_events":103,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"binaryedge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (binaryedge).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"10,983 bytes sent","bytes_sent":10983,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-26T05:51:06","last_seen":"2026-09-15T21:45:10","events_24h":0,"events_7d":1,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Santa Clara","lat":37.3486,"lon":-121.9732,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"sfo2-115.boron.do.prod.binaryedge.ninja","known_scanners":["binaryedge","BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[{"cve_id":"CVE-2025-0282","title":"Ivanti Connect Secure - Stack-based Buffer Overflow","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/dana-na/auth/url_default/welcome.cgi"}],"malware":[],"top_ports":[{"port":3000,"proto":"tcp","label":"Web-alt","count":47},{"port":3342,"proto":"tcp","label":"","count":46},{"port":443,"proto":"tcp","label":"HTTPS","count":6},{"port":51749,"proto":"tcp","label":"","count":3},{"port":3391,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i2511h2_b78ed14e2fd0_ab7e3b40a677","t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d","f20f35624b79af10f537cb4e1e40197e"],"ja4h":["ge10nn0000_000000000000","op10nn0000_000000000000","ge11nn0400_9c3956fad5da"]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":927,"ge10nn0000_000000000000":2363,"op10nn0000_000000000000":1461,"ge11nn0400_9c3956fad5da":1527,"t13i2511h2_b78ed14e2fd0_ab7e3b40a677":79},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36"],"timeline":[{"date":"2026-08-26","count":3},{"date":"2026-08-29","count":47},{"date":"2026-09-03","count":46},{"date":"2026-09-04","count":3},{"date":"2026-09-08","count":3},{"date":"2026-09-15","count":1}],"recent_events":[{"timestamp":"2026-09-15T21:45:10","port":3391,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000.)�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=0oayq3ss\r\n\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"0300002e29e00000000000436f6f6b69653a206d737473686173683d306f6179713373730d0a0100080001000000","method":"","user_agent":"","ja3":"","session":"2f425f99-35c4-453a-beef-e76ff5ba7fbe","seq":1,"duration_ms":100,"bytes_in":46,"bytes_out":15,"enriched":{"digest":"6468618be86a8ee0","label":"RDP (X.224)","strings":["Cookie: mstshash=0oayq3ss"]}},{"timestamp":"2026-09-08T02:16:39","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dana-na/auth/url_default/welcome.cgi","summary":"","payload_hex":"474554202f64616e612d6e612f617574682f75726c5f64656661756c742f77656c636f6d652e63676920485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"f011d8f5-ba3c-4efc-9b78-b4a431810c05","seq":1,"duration_ms":100,"bytes_in":252,"bytes_out":80},{"timestamp":"2026-09-08T02:16:38","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dana-cached/hc/HostCheckerInstaller.osx","summary":"","payload_hex":"474554202f64616e612d6361636865642f68632f486f7374436865636b6572496e7374616c6c65722e6f737820485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"2f257433-dc01-4125-a601-b997c086f915","seq":1,"duration_ms":100,"bytes_in":255,"bytes_out":80},{"timestamp":"2026-09-08T02:16:38","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dana-na/nc/nc_gina_ver.txt","summary":"","payload_hex":"474554202f64616e612d6e612f6e632f6e635f67696e615f7665722e74787420485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"6cd48509-5a69-4cd7-bbf0-e62b9c7489e2","seq":1,"duration_ms":101,"bytes_in":242,"bytes_out":80},{"timestamp":"2026-09-04T23:44:48","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dana-na/auth/url_default/welcome.cgi","summary":"","payload_hex":"474554202f64616e612d6e612f617574682f75726c5f64656661756c742f77656c636f6d652e63676920485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"f3378812-c4e6-41e9-ba19-d5a34192703e","seq":1,"duration_ms":100,"bytes_in":251,"bytes_out":80},{"timestamp":"2026-09-04T23:44:48","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dana-cached/hc/HostCheckerInstaller.osx","summary":"","payload_hex":"474554202f64616e612d6361636865642f68632f486f7374436865636b6572496e7374616c6c65722e6f737820485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"068f0eaa-05da-48c2-a140-68525762bf74","seq":1,"duration_ms":100,"bytes_in":254,"bytes_out":80},{"timestamp":"2026-09-04T23:44:48","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dana-na/nc/nc_gina_ver.txt","summary":"","payload_hex":"474554202f64616e612d6e612f6e632f6e635f67696e615f7665722e74787420485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"dbeef8b1-070c-4aff-84eb-9cb5dbf6615f","seq":1,"duration_ms":100,"bytes_in":241,"bytes_out":80},{"timestamp":"2026-09-03T08:59:23","port":3342,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001I20100\n","payload_hex":"014932303130300a","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"2be5f443-329a-4e90-ab5a-b449bc7fec84","seq":1,"duration_ms":152,"bytes_in":8,"bytes_out":15,"enriched":{"digest":"14b0bf5196552d7e","strings":["I20100"]}},{"timestamp":"2026-09-03T08:59:22","port":3342,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"639fff97-0705-4aaa-8270-9cd9a289d5c7","seq":1,"duration_ms":151,"bytes_in":5,"bytes_out":15},{"timestamp":"2026-09-03T08:59:20","port":3342,"proto":"tcp","app_proto":"tls","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d41646d696e6973747261746f720d0a0100080000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"5916dc8e-b725-4fd9-a9c6-0359f1d5092c","seq":1,"duration_ms":151,"bytes_in":51,"bytes_out":15,"enriched":{"digest":"56a8af4f4fb4faa0","label":"RDP (X.224)","strings":["Cookie: mstshash=Administrator"]}}],"http_methods":[{"method":"GET","count":12},{"method":"OPTIONS","count":4}],"distinct_ports_total":5,"top_paths":[{"path":"/","count":8,"ports":2},{"path":"/dana-na/nc/nc_gina_ver.txt","count":2,"ports":1},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":2,"ports":2},{"path":"/dana-na/auth/url_default/welcome.cgi","count":2,"ports":1},{"path":"/dana-cached/hc/HostCheckerInstaller.osx","count":2,"ports":1}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":6}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":6},"tags":[{"tag_id":"CVE-2025-0282","tag_type":"cve","title":"Ivanti Connect Secure - Stack-based Buffer Overflow","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/dana-na/auth/url_default/welcome.cgi","reference_urls":["https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283","https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/","https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","https://nvd.nist.gov/vuln/detail/CVE-2025-0282"]}],"data_as_of":"2026-09-21T11:34:05.618333+00:00"}