{"ip":"178.128.3.138","total_events":134,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"binaryedge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (binaryedge).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"2,123 bytes sent","bytes_sent":2123,"session_seconds":0,"persistent":false}},"first_seen":"2026-05-16T04:44:39","last_seen":"2026-07-14T05:40:30","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Santa Clara","lat":37.3486,"lon":-121.9732,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"prod-bromine-sfo2-43.do.binaryedge.ninja","known_scanners":["binaryedge","BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[{"cve_id":"CVE-2025-0282","title":"Ivanti Connect Secure - Stack-based Buffer Overflow","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/dana-na/auth/url_default/welcome.cgi"},{"cve_id":"CVE-2019-11507","title":"Pulse Secure Pulse Connect Secure - Cross-Site Scripting (Reflected)","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/dana-na/auth/url_default/welcome.cgi"}],"malware":[],"top_ports":[{"port":4991,"proto":"tcp","label":"","count":46},{"port":2083,"proto":"tcp","label":"","count":46},{"port":2443,"proto":"tcp","label":"","count":33},{"port":626,"proto":"tcp","label":"","count":3},{"port":443,"proto":"tcp","label":"HTTPS","count":3},{"port":995,"proto":"tcp","label":"POP3S","count":2},{"port":1911,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i2511h2_b78ed14e2fd0_ab7e3b40a677","t13i311000_e8f1e7e78f70_d41ae481755e","t13i3112h1_e8f1e7e78f70_d339722ba4af"],"tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d","48eb9b1182293f55c0710654b7b12fc6"],"ja4h":["op10nn0000_000000000000","ge11nn0300_dedeb29cc523","ge11nn0400_9c3956fad5da","ge10nn0000_000000000000"]},"fingerprint_peers":{"t13i2511h2_b78ed14e2fd0_ab7e3b40a677":94,"t13i3112h1_e8f1e7e78f70_d339722ba4af":46,"t13i311000_e8f1e7e78f70_d41ae481755e":1039,"ge10nn0000_000000000000":2350,"op10nn0000_000000000000":1499,"ge11nn0400_9c3956fad5da":1485,"ge11nn0300_dedeb29cc523":96},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"],"timeline":[{"date":"2026-05-16","count":1},{"date":"2026-05-17","count":46},{"date":"2026-05-25","count":3},{"date":"2026-06-03","count":46},{"date":"2026-06-06","count":33},{"date":"2026-06-09","count":3},{"date":"2026-07-14","count":2}],"recent_events":[{"timestamp":"2026-07-14T05:40:30","port":995,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e300d0a0d0a","method":"OPTIONS","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"9ddc4bc5-db6d-4822-9f0b-ad34b2cd9758","seq":1,"duration_ms":253,"bytes_in":22,"bytes_out":5},{"timestamp":"2026-07-14T05:40:28","port":995,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"f329f35f-c72a-468a-8a4c-cfd40f638d76","seq":1,"duration_ms":253,"bytes_in":4,"bytes_out":5},{"timestamp":"2026-06-09T03:49:41","port":626,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip, deflate\",\"host\":\"<HONEYPOT>:626\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f38332e302e343130332e3631205361666172692f3533372e33360d0a486f73743a20<HONEYPOT>3a3632360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36","ja3":"48eb9b1182293f55c0710654b7b12fc6","session":"029daaf8-e00a-4e02-8f94-fc69cd5bac22","seq":1,"duration_ms":100,"bytes_in":204,"bytes_out":78},{"timestamp":"2026-06-09T03:49:39","port":626,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip, deflate\",\"host\":\"<HONEYPOT>:626\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f38332e302e343130332e3631205361666172692f3533372e33360d0a486f73743a20<HONEYPOT>3a3632360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36","ja3":"48eb9b1182293f55c0710654b7b12fc6","session":"12310afc-08b7-4eef-b3bd-cc59b5a691a7","seq":1,"duration_ms":102,"bytes_in":202,"bytes_out":78},{"timestamp":"2026-06-09T03:49:37","port":626,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip, deflate\",\"host\":\"<HONEYPOT>:626\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f38332e302e343130332e3631205361666172692f3533372e33360d0a486f73743a20<HONEYPOT>3a3632360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36","ja3":"48eb9b1182293f55c0710654b7b12fc6","session":"7e21826e-55f1-4363-a442-673307081a70","seq":1,"duration_ms":100,"bytes_in":202,"bytes_out":78},{"timestamp":"2026-06-06T14:41:48","port":2443,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000���\u000b��\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000����\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000/\u00009\u0000.\u0000\u0000.\u0000\u0000.\u0002\u00009\u00008\u0000\u0000;\u0000 \u0000{\u0000\u0000\u0000\u0000\u0000A\u0000A\u0000\u0000\u0000-\u0000\u0000A\u0000\u0000\u0000-\u0000\u0000\u0000a\u0000\u0000-\u0000A\u0000A\u0000\u0000A\u0000-\u0000\u0000\u0000\u0000\u0000A\u0000\u0000A\u0000A\u0000\u0000A\u0000A\u0000\u0000}\u0000\u0000\u0000�m�_","payload_hex":"010000fdcefa0bb0a00000004d4d53140000000000000000000000000000001200000001000300f0f0f0f00b0004001c0003004e00530050006c0061007900650072002f0039002e00002e00002e020039003800003b0020007b00000000004100410000002d0000410000002d0000006100002d00410041000041002d0000000000410000410041000041004100007d000000e06ddf5f","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"f7c0877e-bb9e-40b5-b431-da044412106b","seq":1,"duration_ms":254,"bytes_in":151,"bytes_out":13,"enriched":{"digest":"44194845022cae28","strings":["NSPlayer/9...","98; {AA-A-a-AAA-AAAAA}"]}},{"timestamp":"2026-06-06T14:41:46","port":2443,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"JRMI\u0000\u0002K","payload_hex":"4a524d4900024b","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"7d9b0547-ede5-4a19-8cfc-da9a852e664c","seq":1,"duration_ms":254,"bytes_in":7,"bytes_out":13,"enriched":{"digest":"520dae2bdcec9072","strings":["JRMI"]}},{"timestamp":"2026-06-06T14:41:44","port":2443,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":":\u0000\u0000\u0000/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3a0000002f00000002000040020f0001003d050000000000000000000000002f000000000000000000401f0000000000000000000000000000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"f25b0e5d-912f-4550-88f4-2cfc6ca53eae","seq":1,"duration_ms":254,"bytes_in":60,"bytes_out":13},{"timestamp":"2026-06-06T14:41:42","port":2443,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000�\u0001�\u0013","payload_hex":"446d6454000000170000000100000000111100ff01ff13","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"cda51139-3518-40de-a0c6-8edfebe0b6e2","seq":1,"duration_ms":253,"bytes_in":23,"bytes_out":13,"enriched":{"digest":"2198932494d130c5","strings":["DmdT"]}},{"timestamp":"2026-06-06T14:41:39","port":2443,"proto":"tcp","app_proto":"tls","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u000b\u0006�\u0000\u0000\u0000\u0000\u0000","payload_hex":"0300000b06e00000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"f634d025-cfa2-4bd1-8720-0bbc21efbf33","seq":1,"duration_ms":253,"bytes_in":11,"bytes_out":13,"enriched":{"digest":"c6ea7c5d89294245","label":"TPKT / COTP (ISO-TSAP)"}}],"http_methods":[{"method":"GET","count":15},{"method":"OPTIONS","count":7}],"distinct_ports_total":7,"top_paths":[{"path":"/","count":16,"ports":5},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":3,"ports":3},{"path":"/dana-na/nc/nc_gina_ver.txt","count":1,"ports":1},{"path":"/dana-na/auth/url_default/welcome.cgi","count":1,"ports":1},{"path":"/dana-cached/hc/HostCheckerInstaller.osx","count":1,"ports":1}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":3},{"value":"h2, http/1.1","count":3}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Host","value":"<HONEYPOT>:626","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[{"tag_id":"CVE-2025-0282","tag_type":"cve","title":"Ivanti Connect Secure - Stack-based Buffer Overflow","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/dana-na/auth/url_default/welcome.cgi","reference_urls":["https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283","https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/","https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","https://nvd.nist.gov/vuln/detail/CVE-2025-0282"]},{"tag_id":"CVE-2019-11507","tag_type":"cve","title":"Pulse Secure Pulse Connect Secure - Cross-Site Scripting (Reflected)","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/dana-na/auth/url_default/welcome.cgi","reference_urls":["https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/","https://nvd.nist.gov/vuln/detail/CVE-2019-11507"]}],"data_as_of":"2026-07-30T18:56:56.917814+00:00"}