{"ip":"157.245.239.90","total_events":54,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"binaryedge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (binaryedge).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,552 bytes sent","bytes_sent":5552,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-26T21:35:24","last_seen":"2026-09-15T19:37:02","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Santa Clara","lat":37.3486,"lon":-121.9732,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"sfo2-5.fluorine.do.prod.binaryedge.ninja","known_scanners":["binaryedge","BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":83,"proto":"tcp","label":"","count":47},{"port":3388,"proto":"tcp","label":"","count":3},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":2},{"port":27017,"proto":"tcp","label":"MongoDB","count":1},{"port":80,"proto":"tcp","label":"HTTP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"http_akin":["b10lun000_00000000_334359b9","b11cun040_00040013_608dab68","b11cuq050_00040813_2619b3ac"]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":794,"b10lun000_00000000_334359b9":2216,"b11cun040_00040013_608dab68":4305,"b11cuq050_00040813_2619b3ac":21},"akin_families":{"b10lun000_00000000_334359b9":{"head":"b10lun000_00000000_334359b9","shapes":2,"ips":2216},"b11cun040_00040013_608dab68":{"head":"b11cun040_00040013_608dab68","shapes":2,"ips":4305},"b11cuq050_00040813_2619b3ac":{"head":"b11cuq050_00040813_2619b3ac","shapes":2,"ips":21}},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36"],"timeline":[{"date":"2026-08-26","count":47},{"date":"2026-08-31","count":1},{"date":"2026-09-09","count":1},{"date":"2026-09-12","count":2},{"date":"2026-09-15","count":3}],"recent_events":[{"timestamp":"2026-09-15T19:37:02","port":3388,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"e28aa06d-f87d-4971-8f67-c2855e34e91b","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"4986e56a8738b201","label":"RDP (X.224)"}},{"timestamp":"2026-09-15T19:37:02","port":3388,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"ec25642c-0a72-4f6a-980e-0d197b00b84f","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"af9b397590d28773","label":"RDP (X.224)"}},{"timestamp":"2026-09-15T19:37:02","port":3388,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080000000000","method":"","user_agent":"","ja3":"","session":"7e12d46e-65b1-4910-a38e-8c051b4ce09c","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"b481beafe15f409a","label":"RDP (X.224)"}},{"timestamp":"2026-09-12T13:36:21","port":8443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"","session":"80175782-cd98-4010-8c6b-000043a28bfd","seq":1,"duration_ms":100,"bytes_in":220,"bytes_out":79},{"timestamp":"2026-09-12T13:36:21","port":8443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_layouts/15/error.aspx","summary":"","payload_hex":"474554202f5f6c61796f7574732f31352f6572726f722e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"","session":"9be474c2-48b4-4306-8438-8b6df301eec3","seq":1,"duration_ms":100,"bytes_in":242,"bytes_out":79},{"timestamp":"2026-09-09T12:11:08","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"0\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wsman","summary":"","payload_hex":"504f5354202f77736d616e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a436f6e74656e742d4c656e6774683a20300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"POST","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"","session":"27f5f935-1d3b-4eda-9654-f6dccf910735","seq":1,"duration_ms":100,"bytes_in":241,"bytes_out":79},{"timestamp":"2026-08-31T13:08:53","port":27017,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":":\u0000\u0000\u0000`/�5\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000����\u0013\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\u0000","payload_hex":"3a000000602fe23500000000d40700000000000061646d696e2e24636d640000000000ffffffff130000001069734d6173746572000100000000","method":"","user_agent":"","ja3":"","session":"381b0519-c866-4898-ac9c-16ff66f95b8c","seq":1,"duration_ms":100,"bytes_in":58,"bytes_out":14,"enriched":{"digest":"8719e96bfa9a8270","strings":["admin.$cmd","isMaster"]}},{"timestamp":"2026-08-26T21:36:49","port":83,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001I20100\n","payload_hex":"014932303130300a","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"ea358b34-711b-4df0-b391-9852471b6e7c","seq":1,"duration_ms":151,"bytes_in":8,"bytes_out":14,"enriched":{"digest":"14b0bf5196552d7e","strings":["I20100"]}},{"timestamp":"2026-08-26T21:36:47","port":83,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"d85e5893-430c-4768-93ad-1f98884e63ac","seq":1,"duration_ms":151,"bytes_in":5,"bytes_out":14},{"timestamp":"2026-08-26T21:36:45","port":83,"proto":"tcp","app_proto":"tls","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d41646d696e6973747261746f720d0a0100080000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"b0f70a9b-84fc-4c43-9c19-a0378f89d6ff","seq":1,"duration_ms":152,"bytes_in":51,"bytes_out":14,"enriched":{"digest":"56a8af4f4fb4faa0","label":"RDP (X.224)","strings":["Cookie: mstshash=Administrator"]}}],"http_methods":[{"method":"GET","count":6},{"method":"OPTIONS","count":2},{"method":"POST","count":1}],"distinct_ports_total":5,"top_paths":[{"path":"/","count":5,"ports":2},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":2,"ports":1},{"path":"/wsman","count":1,"ports":1},{"path":"/_layouts/15/error.aspx","count":1,"ports":1}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Content-Length","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"0","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":3},"tags":[],"data_as_of":"2026-09-30T15:29:51.834391+00:00"}