{"ip":"159.89.125.248","total_events":151,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"binaryedge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (binaryedge).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"14,288 bytes sent","bytes_sent":14288,"session_seconds":1,"persistent":false}},"first_seen":"2026-08-29T00:17:35","last_seen":"2026-09-13T05:20:23","events_24h":0,"events_7d":0,"geo":{"country_code":"CA","country_name":"Canada","region":"Ontario","city":"Toronto","lat":43.709,"lon":-79.4057,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"tor1-1.iodine.do.prod.binaryedge.ninja","known_scanners":["binaryedge","BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":8086,"proto":"tcp","label":"InfluxDB","count":46},{"port":10255,"proto":"tcp","label":"","count":46},{"port":1962,"proto":"tcp","label":"","count":46},{"port":110,"proto":"tcp","label":"POP3","count":10},{"port":3344,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"http_akin":[]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":880},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-29","count":46},{"date":"2026-08-31","count":46},{"date":"2026-09-02","count":46},{"date":"2026-09-03","count":3},{"date":"2026-09-13","count":10}],"recent_events":[{"timestamp":"2026-09-13T05:20:23","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e300d0a0d0a","method":"OPTIONS","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"0d3d887e-0c68-48b8-a396-4e35e4b13e54","seq":1,"duration_ms":112,"bytes_in":22,"bytes_out":5},{"timestamp":"2026-09-13T05:20:21","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"9c595b4a-5e1c-4705-9803-0a5939521829","seq":1,"duration_ms":112,"bytes_in":4,"bytes_out":5},{"timestamp":"2026-09-13T05:20:18","port":110,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"HELP\r\n","payload_hex":"48454c500d0a","method":"","user_agent":"","ja3":"","session":"36f89887-e9c8-4145-a08d-56597710732c","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":5,"enriched":{"digest":"d6616dd899abc961","strings":["HELP"]}},{"timestamp":"2026-09-13T05:20:16","port":110,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\f\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"000c000010000000000000000000","method":"","user_agent":"","ja3":"","session":"386b23f1-2981-4f7e-8e88-f59db93d786c","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":5},{"timestamp":"2026-09-13T05:20:15","port":110,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u001e\u0000\u0006\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007version\u0004bind\u0000\u0000\u0010\u0000\u0003","payload_hex":"001e0006010000010000000000000776657273696f6e0462696e640000100003","method":"","user_agent":"","ja3":"","session":"0fcf8377-5687-46d9-b7cb-9bae9d6652a2","seq":1,"duration_ms":100,"bytes_in":32,"bytes_out":5,"enriched":{"digest":"75f479f7d331db45","strings":["version","bind"]}},{"timestamp":"2026-09-13T05:20:13","port":110,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(r�\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0001�|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002872fe1d130000000000000002000186a00001977c0000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"2c5ace5d-db49-44ae-9971-f57775c8ab07","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":5},{"timestamp":"2026-09-13T05:20:11","port":110,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS / RTSP/1.0\r\n\r\n","payload_hex":"4f5054494f4e53202f20525453502f312e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"2d07a7e3-d6ec-445a-8a0d-2c9ba9beccfe","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":5,"enriched":{"digest":"b6bc3f9a3eb2980d","label":"HTTP","strings":["OPTIONS / RTSP/1.0"]}},{"timestamp":"2026-09-13T05:20:10","port":110,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e300d0a0d0a","method":"OPTIONS","user_agent":"","ja3":"","session":"9e604d57-f09d-4d4e-90ae-3e5d841d55ea","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":5},{"timestamp":"2026-09-13T05:20:08","port":110,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"d8b0b6fe-24b9-4eff-9207-5510d477a6a9","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":5},{"timestamp":"2026-09-13T05:20:06","port":110,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"02af522f-d30b-4b2c-b1c6-d9d0b51d2135","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":5}],"http_methods":[{"method":"GET","count":10},{"method":"OPTIONS","count":8}],"distinct_ports_total":5,"top_paths":[{"path":"/","count":15,"ports":4},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":3,"ports":3}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-23T08:50:44.679726+00:00"}