{"ip":"45.79.2.244","total_events":343,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"binaryedge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (binaryedge).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"33,721 bytes sent","bytes_sent":33721,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-31T15:46:32","last_seen":"2026-09-28T23:07:51","events_24h":0,"events_7d":94,"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"Richardson","lat":32.9482,"lon":-96.7297,"asn":63949,"org":"Akamai Connected Cloud"},"source_domain":"us-central-45.beryllium.li.prod.binaryedge.ninja","known_scanners":["binaryedge","BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":8084,"proto":"tcp","label":"","count":47},{"port":2067,"proto":"tcp","label":"","count":46},{"port":3381,"proto":"tcp","label":"","count":46},{"port":1022,"proto":"tcp","label":"","count":46},{"port":3313,"proto":"tcp","label":"","count":46},{"port":101,"proto":"tcp","label":"","count":46},{"port":8883,"proto":"tcp","label":"","count":39},{"port":139,"proto":"tcp","label":"SMB","count":6},{"port":3370,"proto":"tcp","label":"","count":5},{"port":3352,"proto":"tcp","label":"","count":3},{"port":3354,"proto":"tcp","label":"","count":3},{"port":3378,"proto":"tcp","label":"","count":3},{"port":3326,"proto":"tcp","label":"","count":3},{"port":3380,"proto":"tcp","label":"","count":3},{"port":6001,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"1603010200010001fc0303baab56b672e09a9041b1a756108eb7fd47b8dcac5f24c0ab1fa095438f92f9af00003e130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000195000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d00208a890460dca1f1663529cf50263792a75a32fdabf2d40566f458b05c9824653b001500fc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"http_akin":["a10lun000_00000000_334359b9"]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":802,"a10lun000_00000000_334359b9":797},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-31","count":1},{"date":"2026-09-03","count":3},{"date":"2026-09-04","count":2},{"date":"2026-09-05","count":52},{"date":"2026-09-07","count":46},{"date":"2026-09-09","count":46},{"date":"2026-09-13","count":6},{"date":"2026-09-15","count":47},{"date":"2026-09-19","count":46},{"date":"2026-09-23","count":39},{"date":"2026-09-25","count":46},{"date":"2026-09-26","count":3},{"date":"2026-09-27","count":3},{"date":"2026-09-28","count":3}],"recent_events":[{"timestamp":"2026-09-28T23:07:51","port":3370,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"e969dd7a-f88d-4746-a777-2a8ea450000a","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-28T23:07:51","port":3370,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080000000000","method":"","user_agent":"","ja3":"","session":"9ab6b216-9891-4f3f-b2f1-f2b8e1c7b2b3","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"b481beafe15f409a","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-28T23:07:50","port":3370,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"aafc0109-ada8-4df9-b785-ede027f10d30","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-27T19:21:09","port":3352,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"31c9c7fa-c149-43de-9791-8d551efc46c0","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-27T19:21:09","port":3352,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"56ef33b5-e437-4d56-8b4a-a0dc498c42fb","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-27T19:21:09","port":3352,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080000000000","method":"","user_agent":"","ja3":"","session":"e9a475af-6aa7-42aa-b7c7-bfc6f1e9d32c","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"b481beafe15f409a","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-26T09:52:57","port":3326,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"f56b3a33-d91e-41f7-8cae-c7b4f7a802e9","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-26T09:52:57","port":3326,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080000000000","method":"","user_agent":"","ja3":"","session":"b834138c-9a53-40ce-b924-169dff568ca6","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"b481beafe15f409a","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-26T09:52:56","port":3326,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"cd5be1e3-25fc-40fa-9120-d157e866d16d","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":11,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-25T18:13:11","port":3313,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001I20100\n","payload_hex":"014932303130300a","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"f7d147d7-9070-4959-a2ab-d7943e93b27d","seq":1,"duration_ms":123,"bytes_in":8,"bytes_out":11,"enriched":{"digest":"14b0bf5196552d7e","strings":["I20100"]}}],"http_methods":[{"method":"GET","count":22},{"method":"OPTIONS","count":13}],"distinct_ports_total":15,"top_paths":[{"path":"/","count":27,"ports":7},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":8,"ports":7}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T01:05:54.675288+00:00"}