{"ip":"178.62.38.96","total_events":101,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"binaryedge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (binaryedge).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"11,428 bytes sent","bytes_sent":11428,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-28T11:58:46","last_seen":"2026-09-26T03:12:47","events_24h":0,"events_7d":49,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"England","city":"Slough","lat":51.5177,"lon":-0.6215,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"lon1-0.tennessine.do.prod.binaryedge.ninja","known_scanners":["binaryedge","BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":20000,"proto":"tcp","label":"","count":48},{"port":3388,"proto":"tcp","label":"","count":39},{"port":1177,"proto":"tcp","label":"","count":9},{"port":5900,"proto":"tcp","label":"VNC","count":2},{"port":443,"proto":"tcp","label":"HTTPS","count":2},{"port":6380,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i2511h2_b78ed14e2fd0_ab7e3b40a677","t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"16030105f4010005f00303c58021ffe0bfe0b6ed96166ef8b771c02085620f664faeeee675c883c822b40a2065215c7a6655bdb4fadce500b65ee5203256ea5399ac26e34418ad68a7b0d0690032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000575000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a00180804040308070805080604010501060105030603020102030010000e000c02683208687474702f312e31002b0009080304030303020301003304ea04e811ec04c0e5960f4f85a3a51510d678cce79639ee6529e6e1505bb5928af8aeaa520a60343dd4945250712cae25591dd963cb6b8983f13aba47ac80865bfc41c656fb24b89097f3047ba3c134155b82dc653b712205c9e50b54e98a998213c5b1ca2e8780d90290a44c1f9e569f893c8b8497260dc737cc491850ab58970085366a61eb113b4a0acb127981bcabce3c772a1f34402120c9d45b0277b106bfe9be571264771268e21b68fe53b4a385295fe36523c590fe5143f18629b16602bcc0153a1b49764b37a38c893597c2791b993d055a61b6310a3973030348d216b56a3b36e6b25d3a4586fd777720023f9ae072a31989d3a38ab1001edd899997c075e2c310f074bb5c4c33882c4d1f2b32cf70c4343586a30785c16963f30c0de289bd3434c72893a93e6c718c15435f55c073643ccc1b2450f850b0258f4a68c156b8433e1b90e98b75cad04a5ad9cc2e0a6579dc24c989740d168ab173c6be06c06156aba53474e27b5adc729378177771088f884c13da9ac4b7eb052673211fa8b95231ca2ac3119c271784c599356c9f3a18671dd28642179a5b542c0c6c06dcd4b2246c60ca1729e3e2a7ac947f09a02a46d9bc5203859f35b7005d6931573965394ab493b2303a28e9c34af57c86ec54741c997e67aa0374f49dd58924fcb3b16c4676c849c54fc9b16f4572cdd899cfc989b5cb88f323262fca2c867a00ad662710c064dcc1a9cfd92bc95769c81a5ce4836abee6771ea02370a78a93696ec5c50517ca448631b5480c1afd05063cb9912e7505f39270ca378d0762c2bd0b30cbe67c0bb30b15d221a1f638952146ffdc7707aca7262693175c98b9f81ad315629c63519f90923154029dcaa0713a2ded55844eb232f5a293fc4b31a78a8afd9b4c9f15c33faab55811935f559d9ea67b54313a1c4a2cacf4456a25cbe43b35e803199a53c733387d3cf71b18661a1448506deb4bf1130671dc40c72030c2887117a453b151c4b2a6a572250a3d7b96de125cd37c6cd7b21783994751fc21d3a40b3971cdf4b77848492bf3000189f087faf1a79cdbb2f28612f68149c7158e8c3aad550c986e4c8ca082c220fca6884b11c51290e7935f24ba241b263430317000b92306e276be335b9c833d0aa8a0868c7c42fa93a6927ec321a578292e07a393e0bc90c40856d43340a2a64da9744bb0620ccd618e0a838bdf6c7cf8c45c41039bbf58c4ac4c7f206008c65341e3265a908518cd64465e0baf2c62729db7a7a4f8508dda03e5050dc1c86092a767e107b3e05a454377ac33b70ff9f422fd002776a28dd2d748ac28b0634b6f549a0f63c46786a00c9b174056638024e1050b0281a0b915b63b109dc8c3ed707e58529ec1e2926256b26ca42b7dfc296e5ccc8b70727fa928d6a059c6536361b5922eb6c48d346c13c40c92e39fec9aceec14505a013918e565b2a835300838bca9c1544c12732316acc480b5e980fff066b6a14f1c8a14d9a655f49bb1dc629afaa9a6c9827948292363190fc5175a87fa129e6176766919daf5832037ab190c2266fa0d79ac9f8c778e2ba71da167a33da64c322c082165cc0d9086c8a913ee288a16aa0428e7474dca020d30ab6a208356ea899e424cc5b886b3ab5eba37ee57c209a54a0683bc4374c469f74de9da927401d1b0bd74924f4aea0bf3d4682798e6f20190b092ea2ba0ba89180a2d2177e2225c001d0020b0bd74924f4aea0bf3d4682798e6f20190b092ea2ba0ba89180a2d21","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d","f20f35624b79af10f537cb4e1e40197e"],"http_akin":["a11cuq050_0000024e_2619b3ac","a10lun000_00000000_334359b9"]},"fingerprint_peers":{"t13i2511h2_b78ed14e2fd0_ab7e3b40a677":93,"t13i311000_e8f1e7e78f70_d41ae481755e":799,"a11cuq050_0000024e_2619b3ac":4,"a10lun000_00000000_334359b9":806},"akin_families":{},"user_agents":["Go-http-client/1.1","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36"],"timeline":[{"date":"2026-08-28","count":9},{"date":"2026-08-31","count":1},{"date":"2026-09-02","count":39},{"date":"2026-09-04","count":1},{"date":"2026-09-07","count":2},{"date":"2026-09-24","count":48},{"date":"2026-09-26","count":1}],"recent_events":[{"timestamp":"2026-09-26T03:12:47","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"0\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/wsman","summary":"","payload_hex":"504f5354202f77736d616e20485454502f312e310d0a486f73743a200d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a436f6e74656e742d4c656e6774683a20300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"POST","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"f770bf00-2c37-4342-90cb-7d2ddfca7990","seq":1,"duration_ms":115,"bytes_in":241,"bytes_out":77},{"timestamp":"2026-09-24T16:43:17","port":20000,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001I20100\n","payload_hex":"014932303130300a","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"d7e5ec3a-48fc-4990-890b-319ed0286676","seq":1,"duration_ms":201,"bytes_in":8,"bytes_out":12,"enriched":{"digest":"14b0bf5196552d7e","strings":["I20100"]}},{"timestamp":"2026-09-24T16:43:15","port":20000,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"8010a12e-8bf3-4616-b284-6f252d1560d8","seq":1,"duration_ms":204,"bytes_in":5,"bytes_out":12},{"timestamp":"2026-09-24T16:43:13","port":20000,"proto":"tcp","app_proto":"tls","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d41646d696e6973747261746f720d0a0100080000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"d32162f7-3038-4666-bec5-415e628a2b50","seq":1,"duration_ms":200,"bytes_in":51,"bytes_out":12,"enriched":{"digest":"56a8af4f4fb4faa0","label":"RDP (X.224)","strings":["Cookie: mstshash=Administrator"]}},{"timestamp":"2026-09-24T16:43:11","port":20000,"proto":"tcp","app_proto":"tls","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000FINDSCU\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000:Q\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\u001e1.2.826.0.1.3680043.2.1396.999U\u0000\u0000\fCharruaVista","payload_hex":"0100000000cd00010000414e592d53435000000000000000000046494e44534355000000000000000000000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100000030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000003a51000004000040005200001e312e322e3832362e302e312e333638303034332e322e313339362e3939395500000c436861727275615669737461","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"9b3eba89-21a0-4c5e-8299-d5bcd9d98576","seq":1,"duration_ms":203,"bytes_in":211,"bytes_out":12,"enriched":{"digest":"14f9c94d13e59316","label":"DICOM","strings":["ANY-SCP","FINDSCU","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.826.0.1.3680043.2.1396.999U","CharruaVista","ANY-SCPFINDSCU","1.2.840.10008.3.1.1.1 .","1.2.840.10008.1.2P:Q"]}},{"timestamp":"2026-09-24T16:43:09","port":20000,"proto":"tcp","app_proto":"tls","app_protocol":"iscsi","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003�\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000AuthMethod=None\u0000\u0000","payload_hex":"038100000000005f40000137000000000000000100010000000000010000000100000000000000000000000000000000496e69746961746f724e616d653d69716e2e313939312d30352e636f6d2e6d6963726f736f66743a6265696f2d69736373692d70726f62650053657373696f6e547970653d446973636f7665727900417574684d6574686f643d4e6f6e650000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"80afe845-d97e-4ccc-8922-53f8dd467d71","seq":1,"duration_ms":203,"bytes_in":144,"bytes_out":12,"enriched":{"digest":"482810f8d0264f72","label":"iSCSI","strings":["InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe","SessionType=Discovery","AuthMethod=None","InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probeSessionType=DiscoveryAut…"],"iocs":{"domains":["iqn.1991-05.com.microsoft"]}}},{"timestamp":"2026-09-24T16:43:07","port":20000,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000","payload_hex":"000000010000000100000004000000080000000100000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"b664f66f-1350-4d82-8e79-5687bf9297df","seq":1,"duration_ms":203,"bytes_in":24,"bytes_out":12},{"timestamp":"2026-09-24T16:43:05","port":20000,"proto":"tcp","app_proto":"tls","app_protocol":"pptp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000�\u0000\u0001\u001a+\u0000\r\u0000\n\u0000<\u0000s\u0000e\u0000:\u0000H\u0000e\u0000a\u0000d\u0000e\u0000r\u0000>\u0000\r\u0000\n\u0000 \u0000<\u0000p\u0000a\u0000t\u0000h\u0000 \u0000x\u0000m\u0000l\u0000n\u0000s\u0000=\u0000\"\u0000h\u0000t\u0000t\u0000p\u0000:\u0000/\u0000/\u0000s\u0000c\u0000h\u0000e\u0000m\u0000a\u0000s\u0000.\u0000x\u0000m\u0000l\u0000s\u0000o\u0000a\u0000p\u0000.\u0000o\u0000r\u0000g\u0000/\u0000r\u0000p\u0000/\u0000\"\u0000 \u0000s\u0000e\u0000:\u0000m\u0000u\u0000s\u0000t\u0000U\u0000n\u0000d\u0000e\u0000r\u0000s\u0000t\u0000a\u0000n\u0000d\u0000=\u0000\"\u00001\u0000\"\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000<\u0000a\u0000c\u0000t\u0000i\u0000o\u0000n\u0000>\u0000M\u0000S\u0000M\u0000Q\u0000:\u0000p\u0000o\u0000c\u0000<\u0000/\u0000a\u0000c\u0000t\u0000i\u0000o\u0000n\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000<\u0000t\u0000o\u0000>\u0000h\u0000t\u0000t\u0000p\u0000:\u0000/\u0000/\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00001\u00000\u0000.\u00001\u00000\u00000\u0000/\u0000m\u0000s\u0000m\u0000q\u0000/\u0000p\u0000r\u0000i\u0000v\u0000a\u0000t\u0000e\u0000$\u0000/\u0000q\u0000u\u0000e\u0000u\u0000e\u0000j\u0000u\u0000m\u0000p\u0000e\u0000r\u0000<\u0000/\u0000t\u0000o\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000<\u0000i\u0000d\u0000>\u0000u\u0000u\u0000i\u0000d\u0000:\u00001\u0000@\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u0000<\u0000/\u0000i\u0000d\u0000>\u0000\r\u0000\n\u0000 \u0000<\u0000/\u0000p\u0000a\u0000t\u0000h\u0000>\u0000\r\u0000\n\u0000 \u0000<\u0000p\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000i\u0000e\u0000s\u0000 \u0000s\u0000e\u0000:\u0000m\u0000u\u0000s\u0000t\u0000U\u0000n\u0000d\u0000e\u0000r\u0000s\u0000t\u0000a\u0000n\u0000d\u0000=\u0000\"\u00001\u0000\"\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000<\u0000e\u0000x\u0000p\u0000i\u0000r\u0000e\u0000s\u0000A\u0000t\u0000>\u00002\u00000\u00006\u00000\u00000\u00006\u00000\u00009\u0000T\u00001\u00006\u00004\u00004\u00001\u00009\u0000<\u0000/\u0000e\u0000x\u0000p\u0000i\u0000r\u0000e\u0000s\u0000A\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000<\u0000s\u0000e\u0000n\u0000t\u0000A\u0000t\u0000>\u00002\u00000\u00002\u00003\u00000\u00007\u00002\u00004\u0000T\u00001\u00006\u00004\u00004\u00001\u00009\u0000<\u0000/\u0000s\u0000e\u0000n\u0000t\u0000A\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000<\u0000/\u0000p\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000i\u0000e\u0000s\u0000>\u0000\r\u0000\n\u0000<\u0000/\u0000s\u0000e\u0000:\u0000H\u0000e\u0000a\u0000d\u0000e\u0000r\u0000>\u0000\r\u0000\n\u0000<\u0000s\u0000e\u0000:\u0000B\u0000o\u0000d\u0000y\u0000>\u0000<\u0000/\u0000s\u0000e\u0000:\u0000B\u0000o\u0000d\u0000y\u0000>\u0000\r\u0000\n\u0000<\u0000/\u0000s\u0000e\u0000:\u0000E\u0000n\u0000v\u0000e\u0000l\u0000o\u0000p\u0000e\u0000>\u0000\r\u0000\n\u0000\r\u0000\n\u0000\u0000\u0000\u0000\u0000�\u0001\u0000\u0000\f\u0004\u0000\u0000\u0007\u0000\u0000\u0000�\u0003\u0000\u0000POST /msmq HTTP/1.1\r\nContent-Length: 816\r\nContent-Type: multipart/related; boundary=\"MSMQ - SOAP boundary, 53287\"; type=text/xml\r\nHost: 192.168.10.100\r\nSOAPAction: \"MSMQMessage\"\r\nProxy-Accept: NonInteractiveClient\r\n\r\n--MSMQ - SOAP boundary, 53287\r\nContent-Type: text/xml; charset=UTF-8\r\nContent-Length: 606\r\n\r\n\r\n\r\n \r\n MSMQ:poc\r\n http://192.168.10.100/msmq/private$/queuejumper\r\n uuid:1@00000000-0000-0000-0000-000000000000\r\n \r\n \r\n 20600609T164419\r\n 20230724T164419\r\n \r\n\r\n\r\n\r\n\r\n--MSMQ - SOAP boundary, 53287\r\nContent-Type: application/octet-stream\r\nContent-Length: 7\r\nContent-Id: body@ff3af301-3196-497a-a918-72147c871a13\r\n\r\nMessage\r\n--MSMQ - SOAP boundary, 53287--\u0000\f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"100003004c494f524c090000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000063aabe6401000000011c2002600068007400740070003a002f002f003100390032002e003100360038002e00310030002e003100300030002f006d0073006d0071002f00700072006900760061007400650024002f00710075006500750065006a0075006d0070006500720000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070006f0063000000000000001b0200003c00730065003a0045006e00760065006c006f0070006500200078006d006c006e0073003a00730065003d00220068007400740070003a002f002f0073006300680065006d00610073002e0078006d006c0073006f00610070002e006f00720067002f0073006f00610070002f0065006e00760065006c006f00700065002f00220020000d000a0078006d006c006e0073003d00220068007400740070003a002f002f0073006300680065006d00610073002e0078006d006c0073006f00610070002e006f00720067002f00730072006d0070002f0022003e000d000a003c00730065003a004800650061006400650072003e000d000a0020003c007000610074006800200078006d006c006e0073003d00220068007400740070003a002f002f0073006300680065006d00610073002e0078006d006c0073006f00610070002e006f00720067002f00720070002f0022002000730065003a006d0075007300740055006e006400650072007300740061006e0064003d002200310022003e000d000a002000200020003c0061006300740069006f006e003e004d0053004d0051003a0070006f0063003c002f0061006300740069006f006e003e000d000a002000200020003c0074006f003e0068007400740070003a002f002f003100390032002e003100360038002e00310030002e003100300030002f006d0073006d0071002f00700072006900760061007400650024002f00710075006500750065006a0075006d007000650072003c002f0074006f003e000d000a002000200020003c00690064003e0075007500690064003a0031004000300030003000300030003000300030002d0030003000300030002d0030003000300030002d0030003000300030002d003000300030003000300030003000300030003000300030003c002f00690064003e000d000a0020003c002f0070006100740068003e000d000a0020003c00700072006f0070006500720074006900650073002000730065003a006d0075007300740055006e006400650072007300740061006e0064003d002200310022003e000d000a002000200020003c006500780070006900720065007300410074003e003200300036003000300036003000390054003100360034003400310039003c002f006500780070006900720065007300410074003e000d000a002000200020003c00730065006e007400410074003e003200300032003300300037003200340054003100360034003400310039003c002f00730065006e007400410074003e000d000a0020003c002f00700072006f0070006500720074006900650073003e000d000a003c002f00730065003a004800650061006400650072003e000d000a003c00730065003a0042006f00640079003e003c002f00730065003a0042006f00640079003e000d000a003c002f00730065003a0045006e00760065006c006f00700065003e000d000a000d000a0000000000f40100000c04000007000000e3030000504f5354202f6d736d7120485454502f312e310d0a436f6e74656e742d4c656e6774683a203831360d0a436f6e74656e742d547970653a206d756c7469706172742f72656c617465643b20626f756e646172793d224d534d51202d20534f415020626f756e646172792c203533323837223b20747970653d746578742f786d6c0d0a486f73743a203139322e3136382e31302e3130300d0a534f4150416374696f6e3a20224d534d514d657373616765220d0a50726f78792d4163636570743a204e6f6e496e746572616374697665436c69656e740d0a0d0a2d2d4d534d51202d20534f415020626f756e646172792c2035333238370d0a436f6e74656e742d547970653a20746578742f786d6c3b20636861727365743d5554462d380d0a436f6e74656e742d4c656e6774683a203630360d0a0d0a3c73653a456e76656c6f706520786d6c6e733a73653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f22200d0a786d6c6e733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f73726d702f223e0d0a3c73653a4865616465723e0d0a203c7061746820786d6c6e733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f72702f222073653a6d757374556e6465727374616e643d2231223e0d0a2020203c616374696f6e3e4d534d513a706f633c2f616374696f6e3e0d0a2020203c746f3e687474703a2f2f3139322e3136382e31302e3130302f6d736d712f70726976617465242f71756575656a756d7065723c2f746f3e0d0a2020203c69643e757569643a314030303030303030302d303030302d303030302d303030302d3030303030303030303030303c2f69643e0d0a203c2f706174683e0d0a203c70726f706572746965732073653a6d757374556e6465727374616e643d2231223e0d0a2020203c6578706972657341743e3230363030363039543136343431393c2f6578706972657341743e0d0a2020203c73656e7441743e3230323330373234543136343431393c2f73656e7441743e0d0a203c2f70726f706572746965733e0d0a3c2f73653a4865616465723e0d0a3c73653a426f64793e3c2f73653a426f64793e0d0a3c2f73653a456e76656c6f70653e0d0a0d0a2d2d4d534d51202d20534f415020626f756e646172792c2035333238370d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6f637465742d73747265616d0d0a436f6e74656e742d4c656e6774683a20370d0a436f6e74656e742d49643a20626f64794066663361663330312d333139362d343937612d613931382d3732313437633837316131330d0a0d0a4d6573736167650d0a2d2d4d534d51202d20534f415020626f756e646172792c2035333238372d2d000c0000000000000000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"1928a237-6d76-4f6c-9d61-b93971d3dc8d","seq":1,"duration_ms":206,"bytes_in":2380,"bytes_out":12,"enriched":{"digest":"45c6f72bb5aeb522","strings":["LIORL","POST /msmq HTTP/1.1","Content-Length: 816","Content-Type: multipart/related; boundary=\"MSMQ - SOAP boundary, 53287\"; type=te…","Host: 192.168.10.100","SOAPAction: \"MSMQMessage\"","Proxy-Accept: NonInteractiveClient","--MSMQ - SOAP boundary, 53287","Content-Type: text/xml; charset=UTF-8","Content-Length: 606"],"iocs":{"ips":["192.168.10.100"]}}},{"timestamp":"2026-09-24T16:43:01","port":20000,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u000e87�&\b�\u001b��\u0000\u0000\u0000\u0000\u0000","payload_hex":"000e3837a52608a21ba0b10000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"3d78c6ba-1a68-4768-a20b-2e9d9bfdd390","seq":1,"duration_ms":205,"bytes_in":16,"bytes_out":12}],"http_methods":[{"method":"GET","count":5},{"method":"OPTIONS","count":3},{"method":"POST","count":2}],"distinct_ports_total":6,"top_paths":[{"path":"/","count":6,"ports":2},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":2,"ports":2},{"path":"/sdk","count":1,"ports":1},{"path":"/wsman","count":1,"ports":1}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":1}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Content-Length","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"0","notable":false},{"name":"Host","value":"","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-30T03:59:50.818701+00:00"}