{"ip":"69.164.199.185","total_events":237,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"binaryedge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (binaryedge).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"25,125 bytes sent","bytes_sent":25125,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-26T17:06:11","last_seen":"2026-09-21T03:47:20","events_24h":0,"events_7d":48,"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"Richardson","lat":32.9482,"lon":-96.7297,"asn":63949,"org":"Akamai Connected Cloud"},"source_domain":"us-central-5.astatine.li.prod.binaryedge.ninja","known_scanners":["binaryedge","BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":8890,"proto":"tcp","label":"","count":47},{"port":8887,"proto":"tcp","label":"","count":47},{"port":7071,"proto":"tcp","label":"","count":46},{"port":4157,"proto":"tcp","label":"","count":46},{"port":3318,"proto":"tcp","label":"","count":46},{"port":80,"proto":"tcp","label":"HTTP","count":2},{"port":4911,"proto":"tcp","label":"","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1},{"port":5671,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1515h2_8daaf6152771_d8a2da3f94cd","t13i311000_e8f1e7e78f70_d41ae481755e","t13i871000_c66346c74e42_24695f2957a7"],"tls_client_hello":"","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d","cc61f04eb7a2e049ef5095a5eb5a4ae0","68b368fa3d9f97e5c4d4e37250a08a49"]},"fingerprint_peers":{"t13i1515h2_8daaf6152771_d8a2da3f94cd":58,"t13i311000_e8f1e7e78f70_d41ae481755e":896,"t13i871000_c66346c74e42_24695f2957a7":30},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"],"timeline":[{"date":"2026-08-26","count":47},{"date":"2026-08-29","count":46},{"date":"2026-08-30","count":1},{"date":"2026-08-31","count":46},{"date":"2026-09-01","count":46},{"date":"2026-09-10","count":3},{"date":"2026-09-16","count":47},{"date":"2026-09-21","count":1}],"recent_events":[{"timestamp":"2026-09-21T03:47:20","port":4911,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.version=s:3.7.44\nvm.name=s:Java HotSpot(TM) Server VM\nvm.version=s:20.4-b02\nos.name=s:Windows XP\nos.version=s:5.1\nlang=s:en\ntimeZone=s:America/Los_Angeles;-28800000;3600000;02:00:00.000,wall,march,8,on or after,sunday,undefined;02:00:00.000,wall,november,1,on or after,sunday,undefined\nhostId=s:Win-99CB-D49D-5442-07BB\nvmUuid=s:8b530bc8-76c5-4139-a2ea-0fabd394d305\nbrandId=s:vykon\n};;\n","payload_hex":"666f7820612031202d3120666f782068656c6c6f0a7b0a666f782e76657273696f6e3d733a312e300a69643d693a310a686f73744e616d653d733a7870766d2d306f6d64633031786d790a686f7374416464726573733d733a3139322e3136382e312e3132350a6170702e6e616d653d733a576f726b62656e63680a6170702e76657273696f6e3d733a332e372e34340a766d2e6e616d653d733a4a61766120486f7453706f7428544d292053657276657220564d0a766d2e76657273696f6e3d733a32302e342d6230320a6f732e6e616d653d733a57696e646f77732058500a6f732e76657273696f6e3d733a352e310a6c616e673d733a656e0a74696d655a6f6e653d733a416d65726963612f4c6f735f416e67656c65733b2d32383830303030303b333630303030303b30323a30303a30302e3030302c77616c6c2c6d617263682c382c6f6e206f722061667465722c73756e6461792c756e646566696e65643b30323a30303a30302e3030302c77616c6c2c6e6f76656d6265722c312c6f6e206f722061667465722c73756e6461792c756e646566696e65640a686f737449643d733a57696e2d393943422d443439442d353434322d303742420a766d557569643d733a38623533306263382d373663352d343133392d613265612d3066616264333934643330350a6272616e6449643d733a76796b6f6e0a7d3b3b0a","method":"","user_agent":"","ja3":"","session":"7709880a-4b58-49fa-a140-fe7e2f9f3370","seq":1,"duration_ms":100,"bytes_in":513,"bytes_out":14,"enriched":{"digest":"fe39c976bf6d2d07","strings":["fox a 1 -1 fox hello","fox.version=s:1.0","id=i:1","hostName=s:xpvm-0omdc01xmy","hostAddress=s:192.168.1.125","app.name=s:Workbench","app.version=s:3.7.44","vm.name=s:Java HotSpot(TM) Server VM","vm.version=s:20.4-b02","os.name=s:Windows XP"],"iocs":{"ips":["192.168.1.125"],"domains":["fox.version","app.name","app.version","vm.name","vm.version","os.name"]}}},{"timestamp":"2026-09-16T05:46:20","port":8890,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001I20100\n","payload_hex":"014932303130300a","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"0b797ae2-4a0d-4c9d-83e7-523d1db6a603","seq":1,"duration_ms":232,"bytes_in":8,"bytes_out":14,"enriched":{"digest":"14b0bf5196552d7e","strings":["I20100"]}},{"timestamp":"2026-09-16T05:46:18","port":8890,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"b68640d6-62e5-4d56-833a-af1ab2235be3","seq":1,"duration_ms":230,"bytes_in":5,"bytes_out":14},{"timestamp":"2026-09-16T05:46:15","port":8890,"proto":"tcp","app_proto":"tls","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d41646d696e6973747261746f720d0a0100080000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"8080f74c-55b6-4972-9dce-9453e12f854c","seq":1,"duration_ms":231,"bytes_in":51,"bytes_out":14,"enriched":{"digest":"56a8af4f4fb4faa0","label":"RDP (X.224)","strings":["Cookie: mstshash=Administrator"]}},{"timestamp":"2026-09-16T05:46:13","port":8890,"proto":"tcp","app_proto":"tls","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000FINDSCU\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000:Q\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\u001e1.2.826.0.1.3680043.2.1396.999U\u0000\u0000\fCharruaVista","payload_hex":"0100000000cd00010000414e592d53435000000000000000000046494e44534355000000000000000000000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100000030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000003a51000004000040005200001e312e322e3832362e302e312e333638303034332e322e313339362e3939395500000c436861727275615669737461","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"6efb24cf-28b3-473f-b5db-255804b24876","seq":1,"duration_ms":228,"bytes_in":211,"bytes_out":14,"enriched":{"digest":"14f9c94d13e59316","label":"DICOM","strings":["ANY-SCP","FINDSCU","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.826.0.1.3680043.2.1396.999U","CharruaVista","ANY-SCPFINDSCU","1.2.840.10008.3.1.1.1 .","1.2.840.10008.1.2P:Q"]}},{"timestamp":"2026-09-16T05:46:11","port":8890,"proto":"tcp","app_proto":"tls","app_protocol":"iscsi","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003�\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000AuthMethod=None\u0000\u0000","payload_hex":"038100000000005f40000137000000000000000100010000000000010000000100000000000000000000000000000000496e69746961746f724e616d653d69716e2e313939312d30352e636f6d2e6d6963726f736f66743a6265696f2d69736373692d70726f62650053657373696f6e547970653d446973636f7665727900417574684d6574686f643d4e6f6e650000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"05afb71e-2b19-40e7-9ec8-e9cee55a9cc9","seq":1,"duration_ms":233,"bytes_in":144,"bytes_out":14,"enriched":{"digest":"482810f8d0264f72","label":"iSCSI","strings":["InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe","SessionType=Discovery","AuthMethod=None","InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probeSessionType=DiscoveryAut…"],"iocs":{"domains":["iqn.1991-05.com.microsoft"]}}},{"timestamp":"2026-09-16T05:46:09","port":8890,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000","payload_hex":"000000010000000100000004000000080000000100000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"ffdfe4f4-c5b6-4ffb-ad6a-feb934f86f0f","seq":1,"duration_ms":231,"bytes_in":24,"bytes_out":14},{"timestamp":"2026-09-16T05:46:07","port":8890,"proto":"tcp","app_proto":"tls","app_protocol":"pptp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000�\u0000\u0001\u001a+\u0000\r\u0000\n\u0000<\u0000s\u0000e\u0000:\u0000H\u0000e\u0000a\u0000d\u0000e\u0000r\u0000>\u0000\r\u0000\n\u0000 \u0000<\u0000p\u0000a\u0000t\u0000h\u0000 \u0000x\u0000m\u0000l\u0000n\u0000s\u0000=\u0000\"\u0000h\u0000t\u0000t\u0000p\u0000:\u0000/\u0000/\u0000s\u0000c\u0000h\u0000e\u0000m\u0000a\u0000s\u0000.\u0000x\u0000m\u0000l\u0000s\u0000o\u0000a\u0000p\u0000.\u0000o\u0000r\u0000g\u0000/\u0000r\u0000p\u0000/\u0000\"\u0000 \u0000s\u0000e\u0000:\u0000m\u0000u\u0000s\u0000t\u0000U\u0000n\u0000d\u0000e\u0000r\u0000s\u0000t\u0000a\u0000n\u0000d\u0000=\u0000\"\u00001\u0000\"\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000<\u0000a\u0000c\u0000t\u0000i\u0000o\u0000n\u0000>\u0000M\u0000S\u0000M\u0000Q\u0000:\u0000p\u0000o\u0000c\u0000<\u0000/\u0000a\u0000c\u0000t\u0000i\u0000o\u0000n\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000<\u0000t\u0000o\u0000>\u0000h\u0000t\u0000t\u0000p\u0000:\u0000/\u0000/\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00001\u00000\u0000.\u00001\u00000\u00000\u0000/\u0000m\u0000s\u0000m\u0000q\u0000/\u0000p\u0000r\u0000i\u0000v\u0000a\u0000t\u0000e\u0000$\u0000/\u0000q\u0000u\u0000e\u0000u\u0000e\u0000j\u0000u\u0000m\u0000p\u0000e\u0000r\u0000<\u0000/\u0000t\u0000o\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000<\u0000i\u0000d\u0000>\u0000u\u0000u\u0000i\u0000d\u0000:\u00001\u0000@\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u0000-\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u00000\u0000<\u0000/\u0000i\u0000d\u0000>\u0000\r\u0000\n\u0000 \u0000<\u0000/\u0000p\u0000a\u0000t\u0000h\u0000>\u0000\r\u0000\n\u0000 \u0000<\u0000p\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000i\u0000e\u0000s\u0000 \u0000s\u0000e\u0000:\u0000m\u0000u\u0000s\u0000t\u0000U\u0000n\u0000d\u0000e\u0000r\u0000s\u0000t\u0000a\u0000n\u0000d\u0000=\u0000\"\u00001\u0000\"\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000<\u0000e\u0000x\u0000p\u0000i\u0000r\u0000e\u0000s\u0000A\u0000t\u0000>\u00002\u00000\u00006\u00000\u00000\u00006\u00000\u00009\u0000T\u00001\u00006\u00004\u00004\u00001\u00009\u0000<\u0000/\u0000e\u0000x\u0000p\u0000i\u0000r\u0000e\u0000s\u0000A\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000 \u0000 \u0000<\u0000s\u0000e\u0000n\u0000t\u0000A\u0000t\u0000>\u00002\u00000\u00002\u00003\u00000\u00007\u00002\u00004\u0000T\u00001\u00006\u00004\u00004\u00001\u00009\u0000<\u0000/\u0000s\u0000e\u0000n\u0000t\u0000A\u0000t\u0000>\u0000\r\u0000\n\u0000 \u0000<\u0000/\u0000p\u0000r\u0000o\u0000p\u0000e\u0000r\u0000t\u0000i\u0000e\u0000s\u0000>\u0000\r\u0000\n\u0000<\u0000/\u0000s\u0000e\u0000:\u0000H\u0000e\u0000a\u0000d\u0000e\u0000r\u0000>\u0000\r\u0000\n\u0000<\u0000s\u0000e\u0000:\u0000B\u0000o\u0000d\u0000y\u0000>\u0000<\u0000/\u0000s\u0000e\u0000:\u0000B\u0000o\u0000d\u0000y\u0000>\u0000\r\u0000\n\u0000<\u0000/\u0000s\u0000e\u0000:\u0000E\u0000n\u0000v\u0000e\u0000l\u0000o\u0000p\u0000e\u0000>\u0000\r\u0000\n\u0000\r\u0000\n\u0000\u0000\u0000\u0000\u0000�\u0001\u0000\u0000\f\u0004\u0000\u0000\u0007\u0000\u0000\u0000�\u0003\u0000\u0000POST /msmq HTTP/1.1\r\nContent-Length: 816\r\nContent-Type: multipart/related; boundary=\"MSMQ - SOAP boundary, 53287\"; type=text/xml\r\nHost: 192.168.10.100\r\nSOAPAction: \"MSMQMessage\"\r\nProxy-Accept: NonInteractiveClient\r\n\r\n--MSMQ - SOAP boundary, 53287\r\nContent-Type: text/xml; charset=UTF-8\r\nContent-Length: 606\r\n\r\n\r\n\r\n \r\n MSMQ:poc\r\n http://192.168.10.100/msmq/private$/queuejumper\r\n uuid:1@00000000-0000-0000-0000-000000000000\r\n \r\n \r\n 20600609T164419\r\n 20230724T164419\r\n \r\n\r\n\r\n\r\n\r\n--MSMQ - SOAP boundary, 53287\r\nContent-Type: application/octet-stream\r\nContent-Length: 7\r\nContent-Id: body@ff3af301-3196-497a-a918-72147c871a13\r\n\r\nMessage\r\n--MSMQ - SOAP boundary, 53287--\u0000\f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"100003004c494f524c090000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000063aabe6401000000011c2002600068007400740070003a002f002f003100390032002e003100360038002e00310030002e003100300030002f006d0073006d0071002f00700072006900760061007400650024002f00710075006500750065006a0075006d0070006500720000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070006f0063000000000000001b0200003c00730065003a0045006e00760065006c006f0070006500200078006d006c006e0073003a00730065003d00220068007400740070003a002f002f0073006300680065006d00610073002e0078006d006c0073006f00610070002e006f00720067002f0073006f00610070002f0065006e00760065006c006f00700065002f00220020000d000a0078006d006c006e0073003d00220068007400740070003a002f002f0073006300680065006d00610073002e0078006d006c0073006f00610070002e006f00720067002f00730072006d0070002f0022003e000d000a003c00730065003a004800650061006400650072003e000d000a0020003c007000610074006800200078006d006c006e0073003d00220068007400740070003a002f002f0073006300680065006d00610073002e0078006d006c0073006f00610070002e006f00720067002f00720070002f0022002000730065003a006d0075007300740055006e006400650072007300740061006e0064003d002200310022003e000d000a002000200020003c0061006300740069006f006e003e004d0053004d0051003a0070006f0063003c002f0061006300740069006f006e003e000d000a002000200020003c0074006f003e0068007400740070003a002f002f003100390032002e003100360038002e00310030002e003100300030002f006d0073006d0071002f00700072006900760061007400650024002f00710075006500750065006a0075006d007000650072003c002f0074006f003e000d000a002000200020003c00690064003e0075007500690064003a0031004000300030003000300030003000300030002d0030003000300030002d0030003000300030002d0030003000300030002d003000300030003000300030003000300030003000300030003c002f00690064003e000d000a0020003c002f0070006100740068003e000d000a0020003c00700072006f0070006500720074006900650073002000730065003a006d0075007300740055006e006400650072007300740061006e0064003d002200310022003e000d000a002000200020003c006500780070006900720065007300410074003e003200300036003000300036003000390054003100360034003400310039003c002f006500780070006900720065007300410074003e000d000a002000200020003c00730065006e007400410074003e003200300032003300300037003200340054003100360034003400310039003c002f00730065006e007400410074003e000d000a0020003c002f00700072006f0070006500720074006900650073003e000d000a003c002f00730065003a004800650061006400650072003e000d000a003c00730065003a0042006f00640079003e003c002f00730065003a0042006f00640079003e000d000a003c002f00730065003a0045006e00760065006c006f00700065003e000d000a000d000a0000000000f40100000c04000007000000e3030000504f5354202f6d736d7120485454502f312e310d0a436f6e74656e742d4c656e6774683a203831360d0a436f6e74656e742d547970653a206d756c7469706172742f72656c617465643b20626f756e646172793d224d534d51202d20534f415020626f756e646172792c203533323837223b20747970653d746578742f786d6c0d0a486f73743a203139322e3136382e31302e3130300d0a534f4150416374696f6e3a20224d534d514d657373616765220d0a50726f78792d4163636570743a204e6f6e496e746572616374697665436c69656e740d0a0d0a2d2d4d534d51202d20534f415020626f756e646172792c2035333238370d0a436f6e74656e742d547970653a20746578742f786d6c3b20636861727365743d5554462d380d0a436f6e74656e742d4c656e6774683a203630360d0a0d0a3c73653a456e76656c6f706520786d6c6e733a73653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f22200d0a786d6c6e733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f73726d702f223e0d0a3c73653a4865616465723e0d0a203c7061746820786d6c6e733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f72702f222073653a6d757374556e6465727374616e643d2231223e0d0a2020203c616374696f6e3e4d534d513a706f633c2f616374696f6e3e0d0a2020203c746f3e687474703a2f2f3139322e3136382e31302e3130302f6d736d712f70726976617465242f71756575656a756d7065723c2f746f3e0d0a2020203c69643e757569643a314030303030303030302d303030302d303030302d303030302d3030303030303030303030303c2f69643e0d0a203c2f706174683e0d0a203c70726f706572746965732073653a6d757374556e6465727374616e643d2231223e0d0a2020203c6578706972657341743e3230363030363039543136343431393c2f6578706972657341743e0d0a2020203c73656e7441743e3230323330373234543136343431393c2f73656e7441743e0d0a203c2f70726f706572746965733e0d0a3c2f73653a4865616465723e0d0a3c73653a426f64793e3c2f73653a426f64793e0d0a3c2f73653a456e76656c6f70653e0d0a0d0a2d2d4d534d51202d20534f415020626f756e646172792c2035333238370d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6f637465742d73747265616d0d0a436f6e74656e742d4c656e6774683a20370d0a436f6e74656e742d49643a20626f64794066663361663330312d333139362d343937612d613931382d3732313437633837316131330d0a0d0a4d6573736167650d0a2d2d4d534d51202d20534f415020626f756e646172792c2035333238372d2d000c0000000000000000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"75af0f4c-043b-4fb9-9959-42b14d96565e","seq":1,"duration_ms":229,"bytes_in":2380,"bytes_out":14,"enriched":{"digest":"45c6f72bb5aeb522","strings":["LIORL","POST /msmq HTTP/1.1","Content-Length: 816","Content-Type: multipart/related; boundary=\"MSMQ - SOAP boundary, 53287\"; type=te…","Host: 192.168.10.100","SOAPAction: \"MSMQMessage\"","Proxy-Accept: NonInteractiveClient","--MSMQ - SOAP boundary, 53287","Content-Type: text/xml; charset=UTF-8","Content-Length: 606"],"iocs":{"ips":["192.168.10.100"]}}},{"timestamp":"2026-09-16T05:46:03","port":8890,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u000e87�&\b�\u001b��\u0000\u0000\u0000\u0000\u0000","payload_hex":"000e3837a52608a21ba0b10000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"9a228b35-b772-4039-ace4-9879815fee59","seq":1,"duration_ms":227,"bytes_in":16,"bytes_out":14}],"http_methods":[{"method":"GET","count":19},{"method":"OPTIONS","count":10}],"distinct_ports_total":9,"top_paths":[{"path":"/","count":22,"ports":7},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":6,"ports":5},{"path":"/favicon.ico","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":1}],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-22T15:50:50.000426+00:00"}