{"ip":"167.99.107.219","total_events":103,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"binaryedge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (binaryedge).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"9,767 bytes sent","bytes_sent":9767,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-26T13:23:03","last_seen":"2026-09-20T15:06:16","events_24h":0,"events_7d":5,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Santa Clara","lat":37.3486,"lon":-121.9732,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"sfo2-19.boron.do.prod.binaryedge.ninja","known_scanners":["binaryedge","BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":8585,"proto":"tcp","label":"","count":46},{"port":5560,"proto":"tcp","label":"","count":46},{"port":3388,"proto":"tcp","label":"","count":4},{"port":3339,"proto":"tcp","label":"","count":3},{"port":5900,"proto":"tcp","label":"VNC","count":2},{"port":2404,"proto":"tcp","label":"","count":1},{"port":80,"proto":"tcp","label":"HTTP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":894},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36"],"timeline":[{"date":"2026-08-26","count":46},{"date":"2026-08-30","count":46},{"date":"2026-09-03","count":3},{"date":"2026-09-11","count":1},{"date":"2026-09-14","count":2},{"date":"2026-09-15","count":1},{"date":"2026-09-20","count":4}],"recent_events":[{"timestamp":"2026-09-20T15:06:16","port":3388,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080000000000","method":"","user_agent":"","ja3":"","session":"4b95c7e5-d3ac-45f8-a731-53152892cabb","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"b481beafe15f409a","label":"RDP (X.224)"}},{"timestamp":"2026-09-20T15:06:16","port":3388,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"ebc3bfa3-a8b6-4f08-8706-9a0fbf78cb36","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"af9b397590d28773","label":"RDP (X.224)"}},{"timestamp":"2026-09-20T15:06:16","port":3388,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"f0fcafa1-3cba-49a3-b623-691920e1646a","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"4986e56a8738b201","label":"RDP (X.224)"}},{"timestamp":"2026-09-20T02:42:02","port":2404,"proto":"tcp","app_proto":"","app_protocol":"iec60870","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"h\u0004C\u0000\u0000\u0000","payload_hex":"680443000000","method":"","user_agent":"","ja3":"","session":"cd93a29f-01b9-478e-951a-6aa0ec3e4511","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":14},{"timestamp":"2026-09-15T19:27:24","port":3388,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000.)�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=msbiggls\r\n\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"0300002e29e00000000000436f6f6b69653a206d737473686173683d6d73626967676c730d0a0100080001000000","method":"","user_agent":"","ja3":"","session":"178b914c-dd48-475b-85bd-da9d316f8b69","seq":1,"duration_ms":100,"bytes_in":46,"bytes_out":14,"enriched":{"digest":"4e227475218a07fa","label":"RDP (X.224)","strings":["Cookie: mstshash=msbiggls"]}},{"timestamp":"2026-09-14T14:19:49","port":5900,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"167.99.107.2","payload_hex":"3136372e39392e3130372e32","method":"","user_agent":"","ja3":"","session":"cec78fae-ed46-4ed8-a026-ab27effb40ba","seq":1,"duration_ms":100,"bytes_in":12,"bytes_out":14,"enriched":{"digest":"bf225e16588850f5","strings":["167.99.107.2"],"iocs":{"ips":["167.99.107.2"]}}},{"timestamp":"2026-09-14T14:19:49","port":5900,"proto":"tcp","app_proto":"","app_protocol":"vnc","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"RFB 003.003\n","payload_hex":"524642203030332e3030330a","method":"","user_agent":"","ja3":"","session":"1add72fa-5711-4b33-a50d-594834962e78","seq":1,"duration_ms":100,"bytes_in":12,"bytes_out":14,"enriched":{"digest":"061d87a19a1db6ff","label":"VNC (RFB)","strings":["RFB 003.003"]}},{"timestamp":"2026-09-11T16:42:38","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"","session":"f5833d42-003c-4fdc-a028-a97c87a31e2f","seq":1,"duration_ms":100,"bytes_in":215,"bytes_out":79},{"timestamp":"2026-09-03T06:53:00","port":3339,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080000000000","method":"","user_agent":"","ja3":"","session":"7527f6d1-b7fb-4684-9dbe-af115ef4b728","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"b481beafe15f409a","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-03T06:53:00","port":3339,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"88561899-4c0a-44d2-9d39-bebd28a4360b","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":14,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}}],"http_methods":[{"method":"GET","count":7},{"method":"OPTIONS","count":4}],"distinct_ports_total":7,"top_paths":[{"path":"/","count":9,"ports":3},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":2,"ports":2}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-22T16:44:39.818166+00:00"}