{"ip":"198.199.123.131","total_events":606,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"binaryedge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (binaryedge).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"61,021 bytes sent","bytes_sent":61021,"session_seconds":1,"persistent":false}},"first_seen":"2026-08-26T09:56:15","last_seen":"2026-09-30T12:58:10","events_24h":52,"events_7d":95,"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"North Bergen","lat":40.7964,"lon":-74.0203,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"nyc1-56.beryllium.do.prod.binaryedge.ninja","known_scanners":["binaryedge","BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":8050,"proto":"tcp","label":"","count":94},{"port":8250,"proto":"tcp","label":"","count":46},{"port":9200,"proto":"tcp","label":"Elastic","count":46},{"port":6129,"proto":"tcp","label":"","count":46},{"port":3385,"proto":"tcp","label":"","count":46},{"port":50022,"proto":"tcp","label":"","count":46},{"port":1029,"proto":"tcp","label":"","count":46},{"port":1973,"proto":"tcp","label":"","count":46},{"port":8126,"proto":"tcp","label":"","count":46},{"port":8200,"proto":"tcp","label":"","count":46},{"port":1971,"proto":"tcp","label":"","count":46},{"port":3388,"proto":"tcp","label":"","count":39},{"port":3354,"proto":"tcp","label":"","count":3},{"port":3394,"proto":"tcp","label":"","count":3},{"port":3399,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"1603010200010001fc0303995c8e9e2954b5fb790feb7bd9de5562a06eea952fe567a9febc8eb31cd459d500003e130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000195000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d0020958a985f41e7728273c24b9cd0ba6915b28de2c79c6f8c8c625da25f89d93b16001500fc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"http_akin":["b10lun000_00000000_334359b9"]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":792,"b10lun000_00000000_334359b9":2215},"akin_families":{"b10lun000_00000000_334359b9":{"head":"b10lun000_00000000_334359b9","shapes":2,"ips":2215}},"user_agents":[],"timeline":[{"date":"2026-08-26","count":92},{"date":"2026-09-03","count":3},{"date":"2026-09-09","count":46},{"date":"2026-09-11","count":92},{"date":"2026-09-14","count":46},{"date":"2026-09-15","count":140},{"date":"2026-09-17","count":46},{"date":"2026-09-22","count":46},{"date":"2026-09-25","count":3},{"date":"2026-09-26","count":40},{"date":"2026-09-29","count":46},{"date":"2026-09-30","count":6}],"recent_events":[{"timestamp":"2026-09-30T12:58:10","port":3399,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"5b3f4e24-a3d3-42d3-a063-b4be73c10b96","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":15,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-30T12:58:10","port":3399,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"1192b039-eb40-445a-a07b-bce464c63ec0","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":15,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-30T12:58:10","port":3399,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080000000000","method":"","user_agent":"","ja3":"","session":"62d85bee-3604-4f13-a763-5d4b5454b1b8","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":15,"enriched":{"digest":"b481beafe15f409a","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-30T04:05:41","port":3394,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"50079dd5-fad8-44f4-97e3-bad74981c8e6","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":15,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-30T04:05:41","port":3394,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"8266dd12-06a7-4d0e-87c7-0c7f56f3591c","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":15,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-30T04:05:41","port":3394,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080000000000","method":"","user_agent":"","ja3":"","session":"77a3bda4-2b5f-40df-a0f9-f0ff858accdb","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":15,"enriched":{"digest":"b481beafe15f409a","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-29T21:40:23","port":3385,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001I20100\n","payload_hex":"014932303130300a","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"3d2fb779-4cf3-49c5-b12e-1fc55b7799ce","seq":1,"duration_ms":120,"bytes_in":8,"bytes_out":15,"enriched":{"digest":"14b0bf5196552d7e","strings":["I20100"]}},{"timestamp":"2026-09-29T21:40:21","port":3385,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"6e359571-8035-4f97-a264-c26001e2f2f7","seq":1,"duration_ms":120,"bytes_in":5,"bytes_out":15},{"timestamp":"2026-09-29T21:40:19","port":3385,"proto":"tcp","app_proto":"tls","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d41646d696e6973747261746f720d0a0100080000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"35bf563c-3b9e-470c-bfb9-3408973d0edc","seq":1,"duration_ms":120,"bytes_in":51,"bytes_out":15,"enriched":{"digest":"56a8af4f4fb4faa0","label":"RDP (X.224)","strings":["Cookie: mstshash=Administrator"]}},{"timestamp":"2026-09-29T21:40:18","port":3385,"proto":"tcp","app_proto":"tls","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000FINDSCU\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000:Q\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\u001e1.2.826.0.1.3680043.2.1396.999U\u0000\u0000\fCharruaVista","payload_hex":"0100000000cd00010000414e592d53435000000000000000000046494e44534355000000000000000000000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100000030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000003a51000004000040005200001e312e322e3832362e302e312e333638303034332e322e313339362e3939395500000c436861727275615669737461","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"3952ff43-bc32-4ce1-be70-da8982ed9a57","seq":1,"duration_ms":121,"bytes_in":211,"bytes_out":15,"enriched":{"digest":"14f9c94d13e59316","label":"DICOM","strings":["ANY-SCP","FINDSCU","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.826.0.1.3680043.2.1396.999U","CharruaVista","ANY-SCPFINDSCU","1.2.840.10008.3.1.1.1 .","1.2.840.10008.1.2P:Q"]}}],"http_methods":[{"method":"GET","count":38},{"method":"OPTIONS","count":25}],"distinct_ports_total":17,"top_paths":[{"path":"/","count":50,"ports":12},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":13,"ports":12}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T20:53:20.181852+00:00"}