{"ip":"206.189.203.70","total_events":145,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"binaryedge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (binaryedge).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"19,507 bytes sent","bytes_sent":19507,"session_seconds":3,"persistent":false}},"first_seen":"2026-08-27T07:25:56","last_seen":"2026-09-26T04:14:19","events_24h":0,"events_7d":50,"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"North Bergen","lat":40.7964,"lon":-74.0203,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"nyc1-88.boron.do.prod.binaryedge.ninja","known_scanners":["binaryedge","BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":10000,"proto":"tcp","label":"Webmin","count":46},{"port":5632,"proto":"tcp","label":"","count":46},{"port":9443,"proto":"tcp","label":"","count":39},{"port":9200,"proto":"tcp","label":"Elastic","count":8},{"port":443,"proto":"tcp","label":"HTTPS","count":4},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":1},{"port":3389,"proto":"tcp","label":"RDP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i2511h2_b78ed14e2fd0_ab7e3b40a677","t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"16030105f4010005f00303dfb173aacefda2682ff172ce82951b0aad8d23b9596d2ee25c1df0126682d29b20330d2abc63c3c83665ab6fe16c6e4bd865d589644f8c3d7e78940822414d20850032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000575000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a00180804040308070805080604010501060105030603020102030010000e000c02683208687474702f312e31002b0009080304030303020301003304ea04e811ec04c03a248dca146f2fc78be217695bd0098287a5e8080ac2985d94a0cc1d0bd07c742f0846ae52709dd1c6838ca1c8789ab877b93dd5852fd78b959d988def832f6f08a1477252ab9acae7287b6a147c1aa75cc53b4909b95d84ca57afe89f91f0a511423476399c70c87e3b03a55c747f68b0a7c196ad90a46b34fbbfdc845ca21020aa7c4ad55485ef506b9c7c44c3b52d73a562c326397056971f999db1264a54aa0e71cba5a353c39ecc7f68e5b65f3261e3509d62c796ab0abfbd52c6b7b43b469803f0fabdce31370ad0507845bd29c163bb7c57e4fa1f51158f69a046e5d08db6b864185345fe12ce2789a1189435e745631af59ce715c6e18615736116a455cc37a4a458a0208bd42506626308718f185743f40b1977d5ba0b542071f0808ec6ba6725029e3b867fc08618500e4338134cf041b5fb66ede42609aa4953a86dc5e575e67180f20629799b41f038b64b184b5b336592e62c7c5ab2daf9be498a352d818d5cec0b843a5138901c75b14cb99a78a05757d7a3b6e18576221921bc132513897975b8a6fd3b764b149f48c816d9ac65f0381b39a2a6f61119eb00b063e8c1bfc71d7f28b9e0f3547af75934819e71e6c4cd6b39cc3c7e01b0274cd52b32f381b0b18c682358c09bc7db31378b0670dec008df15beacb0bd70fb5d0efc55e0175a0f086ffa66c2150ab1a143622c17422b30436a502ab08bceb47143c901c3770859c87b14249969178b0cb443295b7c4cd2e3149bfc9b1e0217d439434f906d0a537ea6d0355f1511e7744e31f114f2ac0ad49c8a27c68429873cedaa5d451414ac61c8b4c517d9aba97b7a8c4bf78c1762ce076297fd531859e1161e1b380e561699931e6c5ca232e817e04706bc00ca4c43475b8460b53c43f8b97c59faad98a72481f05156f7360e567a3bb1a193f579d13b6890b52edb09396d78682335c6679bc1bd6891fbb810d0fbbd32eb05ebb8c335db6d3d9b93a378c12845053bc4bfd0c263ad9b1abac6092eb5bc9622abf837504e13b1e689809dc653b9ab8ccb4ccfddb187b297c18e28b29b7c226171309c92199d25c1e32bb99121b4b3828f2f20a8a7d284094223a1025445080cc050099538a1734abfa67b912349a309061603a05fbe339d8cd73a2f360581f78fd37903adbc506f0ac046376b163cb41444815fa2c95291a7f790c79d23296961abffc0321837b813ba7385b0656cc55f6632534ff777f6c136cd3054dd2560485643655b58d25ba2c02229044289f8a8553daa38556b6dfdc178d28a605fc4835f18cf63ab76a15a09482913c9466639293efdf201b11793ea5094842501dbac88093787a7716237d13784cc7aee21c4a0865b2ee1258d9251c2a5114ea703bb1ab01a44936b560725bb08f10461d951a7667b949313395797850cf90a92ab66b69a6093fbaf76c043c3894136c62fc936217a9222601493475808eb221af494065d2906fb1712bdd6743e06213f74af79dcb297010264e38558e6ce503a60c39ba8c680cef52132d3f694a77c342c3a73dfe687c54b314096a8aba7ad435792eb842afb3a08d9790023a9a0a40a37741980fb8830bde69880734230824efc4631d3d3409cc01dbb1243b2c469ae7f18b4dc1069ba528a52c72ed46b719b692e6d047677b0c213b2bf609bb1f991a8f441951a770b2584fc7ef8c36caf96d603e368eb8555a5c4e4d103001d00209bb1f991a8f441951a770b2584fc7ef8c36caf96d603e368eb8555a5","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d","f20f35624b79af10f537cb4e1e40197e"],"http_akin":["b11cuq040_00040812_cfad16f7","b11cun040_00040013_608dab68","b11cun030_00040012_13ee3d34","b10lun000_00000000_334359b9"]},"fingerprint_peers":{"t13i2511h2_b78ed14e2fd0_ab7e3b40a677":93,"t13i311000_e8f1e7e78f70_d41ae481755e":798,"b11cun040_00040013_608dab68":4301,"b11cun030_00040012_13ee3d34":5092,"b10lun000_00000000_334359b9":2224,"b11cuq040_00040812_cfad16f7":28},"akin_families":{"b11cun040_00040013_608dab68":{"head":"b11cun040_00040013_608dab68","shapes":2,"ips":4300},"b10lun000_00000000_334359b9":{"head":"b10lun000_00000000_334359b9","shapes":2,"ips":2224}},"user_agents":["python-urllib3/2.7.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36"],"timeline":[{"date":"2026-08-27","count":1},{"date":"2026-08-30","count":46},{"date":"2026-09-01","count":1},{"date":"2026-09-08","count":1},{"date":"2026-09-14","count":8},{"date":"2026-09-16","count":38},{"date":"2026-09-24","count":46},{"date":"2026-09-26","count":4}],"recent_events":[{"timestamp":"2026-09-26T04:14:19","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/Remote","summary":"","payload_hex":"474554202f52656d6f746520485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"405e8ef4-6d47-4c6e-8786-c1eec0756eb5","seq":1,"duration_ms":101,"bytes_in":221,"bytes_out":79},{"timestamp":"2026-09-26T04:14:19","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/RDWeb/Pages/en-US/login.aspx","summary":"","payload_hex":"474554202f52445765622f50616765732f656e2d55532f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"fd945b94-9721-4d54-ba93-d0b2d6951549","seq":1,"duration_ms":100,"bytes_in":243,"bytes_out":79},{"timestamp":"2026-09-26T04:14:18","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/RDWeb","summary":"","payload_hex":"474554202f524457656220485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"618623b3-c037-4916-917e-216eee5a8909","seq":1,"duration_ms":100,"bytes_in":220,"bytes_out":79},{"timestamp":"2026-09-26T04:14:18","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"67854568-fee2-4504-9f2e-2a159b9e2b9e","seq":1,"duration_ms":100,"bytes_in":215,"bytes_out":79},{"timestamp":"2026-09-24T07:58:30","port":10000,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001I20100\n","payload_hex":"014932303130300a","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"01ae44cb-dc7f-414f-9098-8be7c2a4d4cb","seq":1,"duration_ms":180,"bytes_in":8,"bytes_out":14,"enriched":{"digest":"14b0bf5196552d7e","strings":["I20100"]}},{"timestamp":"2026-09-24T07:58:28","port":10000,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"72d443c1-615f-4bd5-98bd-43498af5cfc2","seq":1,"duration_ms":180,"bytes_in":5,"bytes_out":14},{"timestamp":"2026-09-24T07:58:27","port":10000,"proto":"tcp","app_proto":"tls","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d41646d696e6973747261746f720d0a0100080000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"c61317fe-3d1e-4043-a08c-65e9f572fd0e","seq":1,"duration_ms":180,"bytes_in":51,"bytes_out":14,"enriched":{"digest":"56a8af4f4fb4faa0","label":"RDP (X.224)","strings":["Cookie: mstshash=Administrator"]}},{"timestamp":"2026-09-24T07:58:25","port":10000,"proto":"tcp","app_proto":"tls","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000FINDSCU\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000:Q\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\u001e1.2.826.0.1.3680043.2.1396.999U\u0000\u0000\fCharruaVista","payload_hex":"0100000000cd00010000414e592d53435000000000000000000046494e44534355000000000000000000000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100000030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000003a51000004000040005200001e312e322e3832362e302e312e333638303034332e322e313339362e3939395500000c436861727275615669737461","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"524a4338-e026-44c9-bc4d-8b37353b89e4","seq":1,"duration_ms":180,"bytes_in":211,"bytes_out":14,"enriched":{"digest":"14f9c94d13e59316","label":"DICOM","strings":["ANY-SCP","FINDSCU","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.826.0.1.3680043.2.1396.999U","CharruaVista","ANY-SCPFINDSCU","1.2.840.10008.3.1.1.1 .","1.2.840.10008.1.2P:Q"]}},{"timestamp":"2026-09-24T07:58:23","port":10000,"proto":"tcp","app_proto":"tls","app_protocol":"iscsi","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003�\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000AuthMethod=None\u0000\u0000","payload_hex":"038100000000005f40000137000000000000000100010000000000010000000100000000000000000000000000000000496e69746961746f724e616d653d69716e2e313939312d30352e636f6d2e6d6963726f736f66743a6265696f2d69736373692d70726f62650053657373696f6e547970653d446973636f7665727900417574684d6574686f643d4e6f6e650000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"7bf6fb09-d137-41d8-b4a7-baad4b8de9fe","seq":1,"duration_ms":180,"bytes_in":144,"bytes_out":14,"enriched":{"digest":"482810f8d0264f72","label":"iSCSI","strings":["InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe","SessionType=Discovery","AuthMethod=None","InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probeSessionType=DiscoveryAut…"],"iocs":{"domains":["iqn.1991-05.com.microsoft"]}}},{"timestamp":"2026-09-24T07:58:21","port":10000,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000","payload_hex":"000000010000000100000004000000080000000100000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"a2772365-7617-4dc5-9d93-d1e58261524c","seq":1,"duration_ms":180,"bytes_in":24,"bytes_out":14}],"http_methods":[{"method":"GET","count":18},{"method":"OPTIONS","count":5},{"method":"POST","count":4}],"distinct_ports_total":7,"top_paths":[{"path":"/","count":15,"ports":6},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":3,"ports":3},{"path":"/_stats","count":2,"ports":1},{"path":"/_nodes","count":2,"ports":1},{"path":"/_nodes/_local","count":2,"ports":1},{"path":"/RDWeb","count":1,"ports":1},{"path":"/Remote","count":1,"ports":1},{"path":"/RDWeb/Pages/en-US/login.aspx","count":1,"ports":1}],"distinct_paths_total":8,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":4}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[],"data_as_of":"2026-09-30T11:33:22.261060+00:00"}