{"ip":"167.172.217.169","total_events":151,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"BinaryEdge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (BinaryEdge).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"16,177 bytes sent","bytes_sent":16177,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-26T15:12:02","last_seen":"2026-08-30T05:45:11","events_24h":0,"events_7d":151,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Santa Clara","lat":37.3486,"lon":-121.9732,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"sfo2-11.bromine.do.prod.binaryedge.ninja","known_scanners":["BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":4022,"proto":"tcp","label":"MSSQL","count":46},{"port":129,"proto":"tcp","label":"","count":46},{"port":8800,"proto":"tcp","label":"","count":46},{"port":4157,"proto":"tcp","label":"","count":12},{"port":4911,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"ja4h":["ge10nn0000_000000000000","op10nn0000_000000000000"]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":1545,"ge10nn0000_000000000000":2967,"op10nn0000_000000000000":1976},"user_agents":[],"timeline":[{"date":"2026-08-26","count":46},{"date":"2026-08-27","count":46},{"date":"2026-08-29","count":58},{"date":"2026-08-30","count":1}],"recent_events":[{"timestamp":"2026-08-30T05:45:11","port":4911,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.version=s:3.7.44\nvm.name=s:Java HotSpot(TM) Server VM\nvm.version=s:20.4-b02\nos.name=s:Windows XP\nos.version=s:5.1\nlang=s:en\ntimeZone=s:America/Los_Angeles;-28800000;3600000;02:00:00.000,wall,march,8,on or after,sunday,undefined;02:00:00.000,wall,november,1,on or after,sunday,undefined\nhostId=s:Win-99CB-D49D-5442-07BB\nvmUuid=s:8b530bc8-76c5-4139-a2ea-0fabd394d305\nbrandId=s:vykon\n};;\n","payload_hex":"666f7820612031202d3120666f782068656c6c6f0a7b0a666f782e76657273696f6e3d733a312e300a69643d693a310a686f73744e616d653d733a7870766d2d306f6d64633031786d790a686f7374416464726573733d733a3139322e3136382e312e3132350a6170702e6e616d653d733a576f726b62656e63680a6170702e76657273696f6e3d733a332e372e34340a766d2e6e616d653d733a4a61766120486f7453706f7428544d292053657276657220564d0a766d2e76657273696f6e3d733a32302e342d6230320a6f732e6e616d653d733a57696e646f77732058500a6f732e76657273696f6e3d733a352e310a6c616e673d733a656e0a74696d655a6f6e653d733a416d65726963612f4c6f735f416e67656c65733b2d32383830303030303b333630303030303b30323a30303a30302e3030302c77616c6c2c6d617263682c382c6f6e206f722061667465722c73756e6461792c756e646566696e65643b30323a30303a30302e3030302c77616c6c2c6e6f76656d6265722c312c6f6e206f722061667465722c73756e6461792c756e646566696e65640a686f737449643d733a57696e2d393943422d443439442d353434322d303742420a766d557569643d733a38623533306263382d373663352d343133392d613265612d3066616264333934643330350a6272616e6449643d733a76796b6f6e0a7d3b3b0a","method":"","user_agent":"","ja3":"","session":"733caf44-b174-4ed4-8c42-ff0d24751cc7","seq":1,"duration_ms":100,"bytes_in":513,"bytes_out":15,"enriched":{"digest":"fe39c976bf6d2d07","strings":["fox a 1 -1 fox hello","fox.version=s:1.0","id=i:1","hostName=s:xpvm-0omdc01xmy","hostAddress=s:192.168.1.125","app.name=s:Workbench","app.version=s:3.7.44","vm.name=s:Java HotSpot(TM) Server VM","vm.version=s:20.4-b02","os.name=s:Windows XP"],"iocs":{"ips":["192.168.1.125"],"domains":["fox.version","app.name","app.version","vm.name","vm.version","os.name"]}}},{"timestamp":"2026-08-29T23:50:26","port":4157,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\t\u0012;Bo3�D�\u0001�si=�\u0012��\u0019�\u001a:�\u0011ɮ�<0�8��\u0000\u000f�N�\u0005�޷�\u0003\u0003�v�%ѳ*{\n\b�\u0001\u0002}QB�7\u0002��b�F\\\u0011w�H����!��<�Y��娅1��2�\u000b�s��\nsN��S\b;|�d\u0010s�\\i�Vq�ͫ]M��6\u0010��֒���\"\n��?���\u0011)�9��:\u0002\u001f����!�\u000b�v�9\u0014��\u0015;q�V���\u0011�x���Fv���_�!\u0010��C/��\u000f��\u0004������0��5�D","payload_hex":"1b84d5b05df4c493c530c2588cdab1d7acaf6e1de11e1a332a85b71d27b1c96bbff0bc0a4701e101571cdd7a1b4f65cf05b0614643791573410316acb9b0d943da709b2acc198acec262c2760747f22f94ea266f061582404a017a0e9cfd33694251995110e50f071cdb949362324d22e1e220eeb50112a85aaa2665f90c880d58279e05c9cda44748002f7e733b6028267f29b54b5f0202858f0010e485f95937a0f5e20b6e91eb2a23ef4c0da983d0ed07ea737a1c73e657d4d5082f82b5302af6047e33455dfb4de2d89108eaeed59196c3d18ca1ac28e093d6fcf422655559db453a49325fbc8de11c5cfb7ea80a637eafea725a912f55e6e29466e46669635e2ec2faad795126c5036086ee131f9207820cc8d537d241a38a3770a0f233b91ae38fa01b4c4926c7521e6d4511da0dbec5cbd8c454973c526d2d3ce28e0888cbe2f5f91b138e17cb3a7aebc479fefda2064d182fe81965f6ff3e900303de76da25d1b32a7b0a08c701027d5142f53702be8262c7465c11777fd148b1e5b2ff219ba03c94597fb6a9e5a88531f6a232a30bd9739da30a734ea7e753083b7cd4641073bd5c69f45671ebcdab5d4dbeab3610b98fd692c9dcda220ab1c63fb3a2d31129c239f0cb3a021ff3fce99f21f10bf076963914eb9e153b71a75696b2e811d778f9efe84676f2c1c65fa521109fab432f9e8f0fdbce048efc84ace9e830b3c2358444","method":"","user_agent":"","ja3":"","session":"cf4c2f1e-253d-417b-9817-8d16d5de27e0","seq":1,"duration_ms":100,"bytes_in":518,"bytes_out":15,"enriched":{"digest":"2d739036b122bcbb","strings":["aFCy","3iBQ","b2M\"","/~s;`(&","~3E]","\"eUY","E:I2_","fic^.","