{"ip":"167.172.223.46","total_events":419,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"binaryedge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (binaryedge).","Known research and commercial scanners are labelled as such, not as threats."]},"first_seen":"2026-05-17T16:06:06","last_seen":"2026-07-23T19:50:05","events_24h":0,"events_7d":36,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Santa Clara","lat":37.3486,"lon":-121.9732,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"prod-beryllium-sfo2-7.do.binaryedge.ninja","known_scanners":["binaryedge","BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":48},{"port":84,"proto":"tcp","label":"","count":47},{"port":27017,"proto":"tcp","label":"MongoDB","count":46},{"port":9295,"proto":"tcp","label":"","count":46},{"port":5901,"proto":"tcp","label":"","count":46},{"port":138,"proto":"tcp","label":"","count":46},{"port":2064,"proto":"tcp","label":"","count":46},{"port":8099,"proto":"tcp","label":"","count":46},{"port":10050,"proto":"tcp","label":"","count":36},{"port":3388,"proto":"tcp","label":"","count":3},{"port":3336,"proto":"tcp","label":"","count":3},{"port":3479,"proto":"tcp","label":"","count":3},{"port":992,"proto":"tcp","label":"","count":1},{"port":9100,"proto":"tcp","label":"Printer","count":1},{"port":1181,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e","t13i3112h1_e8f1e7e78f70_d339722ba4af"],"tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d","48eb9b1182293f55c0710654b7b12fc6"],"ja4h":["ge10nn0000_000000000000","op10nn0000_000000000000","ge11nn0300_dedeb29cc523"]},"fingerprint_peers":{"t13i3112h1_e8f1e7e78f70_d339722ba4af":36,"t13i311000_e8f1e7e78f70_d41ae481755e":1030,"ge10nn0000_000000000000":2236,"op10nn0000_000000000000":1417,"ge11nn0300_dedeb29cc523":85},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"],"timeline":[{"date":"2026-05-17","count":3},{"date":"2026-05-21","count":1},{"date":"2026-05-27","count":3},{"date":"2026-06-04","count":1},{"date":"2026-06-06","count":46},{"date":"2026-06-07","count":46},{"date":"2026-06-08","count":92},{"date":"2026-06-10","count":46},{"date":"2026-06-16","count":1},{"date":"2026-06-28","count":3},{"date":"2026-07-12","count":48},{"date":"2026-07-13","count":46},{"date":"2026-07-15","count":47},{"date":"2026-07-23","count":36}],"recent_events":[{"timestamp":"2026-07-23T19:50:05","port":10050,"proto":"tcp","app_proto":"tls","app_protocol":"afp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000","payload_hex":"000300010000000000000002000000000f00","method":"","user_agent":"","community_id":"1:QTObLu0Pi4h65w6fFTKxESxQ9zg=","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"6ec1fbe4-05be-43fc-9937-c91c90bbfacc","seq":1,"duration_ms":255,"bytes_in":18,"bytes_out":14},{"timestamp":"2026-07-23T19:50:03","port":10050,"proto":"tcp","app_proto":"tls","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004�\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000","payload_hex":"1201003400000000000015000601001b000102001c000c0300280004ff080001550000004d5353514c53657276657200480f0000","method":"","user_agent":"","community_id":"1:iwCESVZyBfaBkoZMH6MnvqiGZD0=","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"722b8764-c8ce-49b9-a6b5-574323fc6791","seq":1,"duration_ms":253,"bytes_in":52,"bytes_out":14,"enriched":{"digest":"9852857ade38ccb3","strings":["MSSQLServer","UMSSQLServerH"]}},{"timestamp":"2026-07-23T19:50:01","port":10050,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000�\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004�\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))","payload_hex":"005a0000010000000136012c000008007fff7f08000000010020003a00000000000000000000000000000004e600000001000000000000000028434f4e4e4543545f444154413d28434f4d4d414e443d76657273696f6e2929","method":"","user_agent":"","community_id":"1:oNIxKJxKVcsqQ/E+ZA/E5jA9pzA=","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"837ef8e8-e779-4c1e-a0fb-9feaf8e76808","seq":1,"duration_ms":254,"bytes_in":89,"bytes_out":14,"enriched":{"digest":"021ae4ed85d78c7b","strings":["(CONNECT_DATA=(COMMAND=version))"]}},{"timestamp":"2026-07-23T19:49:59","port":10050,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000���\u000b��\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000����\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000/\u00009\u0000.\u0000\u0000.\u0000\u0000.\u0002\u00009\u00008\u0000\u0000;\u0000 \u0000{\u0000\u0000\u0000\u0000\u0000A\u0000A\u0000\u0000\u0000-\u0000\u0000A\u0000\u0000\u0000-\u0000\u0000\u0000a\u0000\u0000-\u0000A\u0000A\u0000\u0000A\u0000-\u0000\u0000\u0000\u0000\u0000A\u0000\u0000A\u0000A\u0000\u0000A\u0000A\u0000\u0000}\u0000\u0000\u0000�m�_","payload_hex":"010000fdcefa0bb0a00000004d4d53140000000000000000000000000000001200000001000300f0f0f0f00b0004001c0003004e00530050006c0061007900650072002f0039002e00002e00002e020039003800003b0020007b00000000004100410000002d0000410000002d0000006100002d00410041000041002d0000000000410000410041000041004100007d000000e06ddf5f","method":"","user_agent":"","community_id":"1:FjRXeW2CvJKUpybXAoqlusMR180=","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"d6d62238-35ed-48a6-9062-745b2e24052d","seq":1,"duration_ms":253,"bytes_in":151,"bytes_out":14,"enriched":{"digest":"44194845022cae28","strings":["NSPlayer/9...","98; {AA-A-a-AAA-AAAAA}"]}},{"timestamp":"2026-07-23T19:49:56","port":10050,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"JRMI\u0000\u0002K","payload_hex":"4a524d4900024b","method":"","user_agent":"","community_id":"1:A1gfmGbOreGpkPRoxZLcXEWrTJQ=","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"84f4aefb-ca3e-4a55-b639-b4d9ef1cbc75","seq":1,"duration_ms":254,"bytes_in":7,"bytes_out":14,"enriched":{"digest":"520dae2bdcec9072","strings":["JRMI"]}},{"timestamp":"2026-07-23T19:49:54","port":10050,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":":\u0000\u0000\u0000/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3a0000002f00000002000040020f0001003d050000000000000000000000002f000000000000000000401f0000000000000000000000000000000000","method":"","user_agent":"","community_id":"1:B1PmFQ6XvzgDFArYT6UI25Wdztg=","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"08b1e05f-d167-426f-8503-9306347248d4","seq":1,"duration_ms":255,"bytes_in":60,"bytes_out":14},{"timestamp":"2026-07-23T19:49:52","port":10050,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000�\u0001�\u0013","payload_hex":"446d6454000000170000000100000000111100ff01ff13","method":"","user_agent":"","community_id":"1:I72RWo6JlFhbnpvIKpFU+Zvf6TU=","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"82a94643-5513-4d47-95d6-adc49d5a7d14","seq":1,"duration_ms":253,"bytes_in":23,"bytes_out":14,"enriched":{"digest":"2198932494d130c5","strings":["DmdT"]}},{"timestamp":"2026-07-23T19:49:50","port":10050,"proto":"tcp","app_proto":"tls","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u000b\u0006�\u0000\u0000\u0000\u0000\u0000","payload_hex":"0300000b06e00000000000","method":"","user_agent":"","community_id":"1:DSZxVwYZLEpZ09B2IwJQ1KmvFXo=","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"27b5bac2-c151-44b2-81ac-306764f07b5b","seq":1,"duration_ms":253,"bytes_in":11,"bytes_out":14,"enriched":{"digest":"c6ea7c5d89294245","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-07-23T19:49:47","port":10050,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"TNMP\u0004\u0000\u0000\u0000TNME\u0000\u0000\u0004\u0000","payload_hex":"544e4d5004000000544e4d4500000400","method":"","user_agent":"","community_id":"1:BDVezScs7HlJpYP3ARDYIoenaY4=","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"10963065-5dcb-4477-81bb-169be16ff08e","seq":1,"duration_ms":255,"bytes_in":16,"bytes_out":14,"enriched":{"digest":"5a85151d1216831b","strings":["TNMP","TNME"]}},{"timestamp":"2026-07-23T19:49:45","port":10050,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"OPTIONS sip:nm SIP/2.0\r\nVia: SIP/2.0/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nMax-Forwards: 70\r\nContent-Length: 0\r\nContact: <sip:nm@nm>\r\nAccept: application/sdp\r\n\r\n","payload_hex":"4f5054494f4e53207369703a6e6d205349502f322e300d0a5669613a205349502f322e302f544350206e6d3b6272616e63683d666f6f0d0a46726f6d3a203c7369703a6e6d406e6d3e3b7461673d726f6f740d0a546f3a203c7369703a6e6d32406e6d323e0d0a43616c6c2d49443a2035303030300d0a435365713a203432204f5054494f4e530d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d4c656e6774683a20300d0a436f6e746163743a203c7369703a6e6d406e6d3e0d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","community_id":"1:l8oOXXpd9htCowwM3y/yVo9Ggo4=","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"85df2e23-cb5d-4402-a250-131b8edae230","seq":1,"duration_ms":256,"bytes_in":223,"bytes_out":79,"enriched":{"digest":"45f1bd546a73d03c","label":"HTTP","strings":["OPTIONS sip:nm SIP/2.0","Via: SIP/2.0/TCP nm;branch=foo","From: <sip:nm@nm>;tag=root","To: <sip:nm2@nm2>","Call-ID: 50000","CSeq: 42 OPTIONS","Max-Forwards: 70","Content-Length: 0","Contact: <sip:nm@nm>","Accept: application/sdp"],"iocs":{"paths":["/2.0/TCP"]}}}],"http_methods":[{"method":"GET","count":35},{"method":"OPTIONS","count":18}],"distinct_ports_total":15,"top_paths":[{"path":"/","count":42,"ports":13},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":11,"ports":9}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":6}],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-07-26T12:42:58.795387+00:00"}