{"ip":"167.172.127.97","total_events":148,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"binaryedge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (binaryedge).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"14,445 bytes sent","bytes_sent":14445,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-26T04:49:18","last_seen":"2026-09-21T03:02:54","events_24h":3,"events_7d":5,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Santa Clara","lat":37.3486,"lon":-121.9732,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"sfo2-51.boron.do.prod.binaryedge.ninja","known_scanners":["binaryedge","BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":31337,"proto":"tcp","label":"","count":47},{"port":7777,"proto":"tcp","label":"Oracle","count":47},{"port":611,"proto":"tcp","label":"","count":46},{"port":3318,"proto":"tcp","label":"","count":3},{"port":3304,"proto":"tcp","label":"","count":3},{"port":1433,"proto":"tcp","label":"MSSQL","count":1},{"port":587,"proto":"tcp","label":"SMTP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e","t13i250800_b78ed14e2fd0_97f8aa674fd9"],"tls_client_hello":"","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d","decb6c22b04a4c718e3db582f6bc571e"]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":917,"t13i250800_b78ed14e2fd0_97f8aa674fd9":13},"user_agents":[],"timeline":[{"date":"2026-08-26","count":47},{"date":"2026-08-27","count":46},{"date":"2026-08-31","count":47},{"date":"2026-09-01","count":3},{"date":"2026-09-15","count":1},{"date":"2026-09-19","count":1},{"date":"2026-09-21","count":3}],"recent_events":[{"timestamp":"2026-09-21T03:02:54","port":3304,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080000000000","method":"","user_agent":"","ja3":"","session":"0228d767-61c7-4c72-aa04-3635c61ce3c9","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"b481beafe15f409a","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-21T03:02:54","port":3304,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"9d18eeca-5fc3-46aa-a469-4597e89583df","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-21T03:02:54","port":3304,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"5c64c6e1-d3f9-4a9b-88d4-62f1fdc929e6","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-19T12:02:23","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000020000001a00060100200001020021000103002200040400260001ff00000000000001000000000000","method":"","user_agent":"","ja3":"","session":"0e022163-11a1-4a25-b9ea-31e13fbd5f97","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":14},{"timestamp":"2026-09-15T12:51:08","port":587,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"EHLO\r\n","payload_hex":"45484c4f0d0a","method":"","user_agent":"","ja3":"decb6c22b04a4c718e3db582f6bc571e","session":"c214867a-df70-43a8-bb7b-6e44a3392ed0","seq":1,"duration_ms":254,"bytes_in":6,"bytes_out":40,"enriched":{"digest":"87f781591201aca6","label":"SMTP","strings":["EHLO"]}},{"timestamp":"2026-09-01T12:23:38","port":3318,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080000000000","method":"","user_agent":"","ja3":"","session":"451e4644-c9f2-4545-abd6-3ab1ea3a1752","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"b481beafe15f409a","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-01T12:23:38","port":3318,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"845ee185-b72c-4b01-821c-051dbf6febbc","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-01T12:23:38","port":3318,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"22f69ea5-59fb-4ad3-9b85-02ccfeb01202","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-31T13:26:54","port":7777,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001I20100\n","payload_hex":"014932303130300a","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"621e0476-490d-4227-ab2c-3f80e77aace8","seq":1,"duration_ms":152,"bytes_in":8,"bytes_out":14,"enriched":{"digest":"14b0bf5196552d7e","strings":["I20100"]}},{"timestamp":"2026-08-31T13:26:52","port":7777,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"53ee9574-e485-4b0c-bad5-8ad86f14ed5d","seq":1,"duration_ms":151,"bytes_in":5,"bytes_out":14}],"http_methods":[{"method":"GET","count":9},{"method":"OPTIONS","count":6}],"distinct_ports_total":7,"top_paths":[{"path":"/","count":12,"ports":3},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":3,"ports":3}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-22T01:42:10.155228+00:00"}