{"ip":"165.22.168.143","total_events":52,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"binaryedge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (binaryedge).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,835 bytes sent","bytes_sent":5835,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-25T18:09:14","last_seen":"2026-09-27T22:17:47","events_24h":0,"events_7d":3,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Santa Clara","lat":37.3486,"lon":-121.9732,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"sfo2-1.iodine.do.prod.binaryedge.ninja","known_scanners":["binaryedge","BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":1521,"proto":"tcp","label":"Oracle","count":47},{"port":443,"proto":"tcp","label":"HTTPS","count":4},{"port":3388,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i2511h2_b78ed14e2fd0_ab7e3b40a677","t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"16030105f4010005f003033b83a94367602ad0597a6be7a21482e18adcac427c21f2cd74b9f423881c0fd920ade0b3fa1d26baf245e3c247112d25e117704df3d54e4e2e8e6690bb167339850032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000575000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a00180804040308070805080604010501060105030603020102030010000e000c02683208687474702f312e31002b0009080304030303020301003304ea04e811ec04c0bf8231e02ac1446127aa27825d532af0a7a776e94af8b5b5cf98424679c9de185a8308a4e34c5c1259365f863be109c821296051831b51fc6d4aab1045650f0fe15ba4d86d76385d27a02b8af6341e32059aa63a826124dfb0876990b2e67ccd736911c4523b8ce8296ff1206580535212c485616e65e416b894ab49fbb3b1a4917aa5203e4cbe3562588059bc268a79792c6306c104aaac7976207b39a67bbb4a812c3995aadcac85b07ddb385c42d482a5c450810cc6d923921c707109896a3e27081640b951a0836328c9a6046583fc6891f872cba37f6e434c4c32356337c4f04a6ec35025454a5e75d53194368fd826c9e5b95328b80bb5c91f88f1ace3518d03a04357f5cb7d1c1f15368092195300134a42228fa34892e15183db7412b4ca243e45375d5a2998632c03f878d0814965db1a25e9b1ae8046be050c71511375554ff472463e4c2b55585d678726831b9907f8090cb8159d7a02e5c27e1486020f9a148fca804fe932327c6fa31470533a02b435c859d65c2d04785d15a060d9128c5025929c3d21770f663c1496112c5ba9396339598e3b56dc454c050474f84bafa4f3cbc487781a506ede777a1b1c188f6271607190b60a0e3047ced1f61091c66385275b6658a0cb24c74cf95815fb2b5dd7bd64053d1b47c59d3c555934a18b192a2b5a008f856ac1042746b59c8a8c24fb9903b8c7197de5b618907f2f75c5b0388a49798b56457c52840291f40690fa4ad9a1c11118784a32adc93c610886769e31c2dbc532a64218ce6077e4843efc795d5f25a5efeb6e5843002d5b57ae58b54b888af2e561d186ae60c485ac640411f45cc79855b73930c4b63ecd0b7d7b2b11d1fa107ed4489da32572263ebd42253c262d9350298a5447e3083d8d4b3efd609ceacba2a9418e063a2e50ac04fc5543045b50bacb0566895fd8f04f04ba1c1dd878bd6acab8b33c4f612918ab66b6e6bea0a1b8d624c72a9ab4a0e47bc527a96de99f07213010a935cb4943158720ee94c4a6a69077785199e9365c460ae7d2a45606a233405de6c7028747af2a400c51c9a18ac5704fc486894cbcc4ac3c15f559b25c9f341568be8ba6c4100bb45b0acbca8c9a76649bb841445487860cb8584c30226935f8ba59eb3a8b9184a9584a0d101ac44d7bbfc977a3a038077ad2b2dbb963b9eb5710535840d05ed04cb3d1b496d108702f573e4a2685da484cc8195e26c1a32953b2df685a7a069cd93051d3ab524b62762022a78b41290513adee90cc68892b494c4e74a5a23c4cbd50e45a70b21c7147010852c3552c1c3a050d9deb3160905d26b3079899c2d838ab6b106871bc2dc01306e6962c66367c8dc61f08a5058ee1b81044b724a7b8e03884a1a098ad9b4cf91431e0fa668ae1ae09da03a03492a2c6aab06538936cb2f852b673990066f5af864288dfd090aa7892f6f21f9d6c2218d19834a866fbb968c31b577fe1c8ec537892231ad563aa1525c96fea277087adfbd120cb3681ae4ca250e9a3c6bb8b306bc4b47bc8aab882a2754efddcc90c7168beb97e7f71223f133c2477ae79389ba6f86846297841eb38f5172375285a2f42a9aaa1637d472787fa83feb751700a0a651a0eaaed707f42669c9f33c6d3bb4bc7c2b4f649a65117ace99c14cce5c5152c75f32a4e57f703615768c4be181abf2b5bed6bdd1201f05ca3179fc71b397a001d00202c75f32a4e57f703615768c4be181abf2b5bed6bdd1201f05ca3179f","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d","f20f35624b79af10f537cb4e1e40197e"],"http_akin":["b11cun040_00040013_608dab68","b10lun000_00000000_334359b9","b11cuq050_00040813_2619b3ac"]},"fingerprint_peers":{"t13i2511h2_b78ed14e2fd0_ab7e3b40a677":93,"t13i311000_e8f1e7e78f70_d41ae481755e":793,"b11cun040_00040013_608dab68":4310,"b10lun000_00000000_334359b9":2217,"b11cuq050_00040813_2619b3ac":21},"akin_families":{"b10lun000_00000000_334359b9":{"head":"b10lun000_00000000_334359b9","shapes":2,"ips":2217},"b11cuq050_00040813_2619b3ac":{"head":"b11cuq050_00040813_2619b3ac","shapes":2,"ips":21}},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36"],"timeline":[{"date":"2026-08-25","count":1},{"date":"2026-08-28","count":47},{"date":"2026-09-04","count":1},{"date":"2026-09-27","count":3}],"recent_events":[{"timestamp":"2026-09-27T22:17:47","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/owa/auth/logon.aspx","summary":"","payload_hex":"474554202f6f77612f617574682f6c6f676f6e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"99547547-a149-4915-98a3-cda6a8c8d58c","seq":1,"duration_ms":100,"bytes_in":236,"bytes_out":79},{"timestamp":"2026-09-27T22:17:46","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/owa/auth/errorFE.aspx?httpCode=500","summary":"","payload_hex":"474554202f6f77612f617574682f6572726f7246452e617370783f68747470436f64653d35303020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"0b39e685-5b0c-48ec-93f8-99bf3939552a","seq":1,"duration_ms":101,"bytes_in":251,"bytes_out":79},{"timestamp":"2026-09-27T22:17:46","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application","summary":"","payload_hex":"474554202f6563702f43757272656e742f6578706f7274746f6f6c2f6d6963726f736f66742e65786368616e67652e65646973636f766572792e6578706f7274746f6f6c2e6170706c69636174696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"34cd0b8f-0f59-4b14-a0ec-fd28acf0b041","seq":1,"duration_ms":100,"bytes_in":292,"bytes_out":79},{"timestamp":"2026-09-04T23:46:32","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"0\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/wsman","summary":"","payload_hex":"504f5354202f77736d616e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a436f6e74656e742d4c656e6774683a20300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"POST","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"d0787e09-a90a-43af-85a7-2ba825602042","seq":1,"duration_ms":100,"bytes_in":240,"bytes_out":79},{"timestamp":"2026-08-28T16:40:20","port":1521,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001I20100\n","payload_hex":"014932303130300a","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"0b4250ea-dbfd-4daa-851f-218886a86ffc","seq":1,"duration_ms":250,"bytes_in":8,"bytes_out":14,"enriched":{"digest":"14b0bf5196552d7e","strings":["I20100"]}},{"timestamp":"2026-08-28T16:40:17","port":1521,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"70afbced-3f5c-46ff-babc-6be5ea403258","seq":1,"duration_ms":243,"bytes_in":5,"bytes_out":14},{"timestamp":"2026-08-28T16:40:15","port":1521,"proto":"tcp","app_proto":"tls","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d41646d696e6973747261746f720d0a0100080000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"1f1327db-cbfa-46e3-b193-0369e5146dd4","seq":1,"duration_ms":247,"bytes_in":51,"bytes_out":14,"enriched":{"digest":"56a8af4f4fb4faa0","label":"RDP (X.224)","strings":["Cookie: mstshash=Administrator"]}},{"timestamp":"2026-08-28T16:40:13","port":1521,"proto":"tcp","app_proto":"tls","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000FINDSCU\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000:Q\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\u001e1.2.826.0.1.3680043.2.1396.999U\u0000\u0000\fCharruaVista","payload_hex":"0100000000cd00010000414e592d53435000000000000000000046494e44534355000000000000000000000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100000030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000003a51000004000040005200001e312e322e3832362e302e312e333638303034332e322e313339362e3939395500000c436861727275615669737461","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"147545e2-7362-4bc9-a77c-a7f3a2c726d9","seq":1,"duration_ms":242,"bytes_in":211,"bytes_out":14,"enriched":{"digest":"14f9c94d13e59316","label":"DICOM","strings":["ANY-SCP","FINDSCU","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.826.0.1.3680043.2.1396.999U","CharruaVista","ANY-SCPFINDSCU","1.2.840.10008.3.1.1.1 .","1.2.840.10008.1.2P:Q"]}},{"timestamp":"2026-08-28T16:40:11","port":1521,"proto":"tcp","app_proto":"tls","app_protocol":"iscsi","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003�\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000AuthMethod=None\u0000\u0000","payload_hex":"038100000000005f40000137000000000000000100010000000000010000000100000000000000000000000000000000496e69746961746f724e616d653d69716e2e313939312d30352e636f6d2e6d6963726f736f66743a6265696f2d69736373692d70726f62650053657373696f6e547970653d446973636f7665727900417574684d6574686f643d4e6f6e650000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"e45b884d-1295-45d0-96ad-3dafd8122750","seq":1,"duration_ms":246,"bytes_in":144,"bytes_out":14,"enriched":{"digest":"482810f8d0264f72","label":"iSCSI","strings":["InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe","SessionType=Discovery","AuthMethod=None","InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probeSessionType=DiscoveryAut…"],"iocs":{"domains":["iqn.1991-05.com.microsoft"]}}},{"timestamp":"2026-08-28T16:40:09","port":1521,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000","payload_hex":"000000010000000100000004000000080000000100000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"4cf67cca-659b-493f-a3f1-999c86c9206f","seq":1,"duration_ms":246,"bytes_in":24,"bytes_out":14}],"http_methods":[{"method":"GET","count":6},{"method":"OPTIONS","count":2},{"method":"POST","count":1}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":4,"ports":1},{"path":"/wsman","count":1,"ports":1},{"path":"/owa/auth/logon.aspx","count":1,"ports":1},{"path":"/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application","count":1,"ports":1},{"path":"/owa/auth/errorFE.aspx?httpCode=500","count":1,"ports":1},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":1,"ports":1}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":4}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Content-Length","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"0","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":4},"tags":[],"data_as_of":"2026-09-30T17:37:23.238727+00:00"}