{"ip":"74.207.241.169","total_events":42,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"binaryedge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (binaryedge).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,908 bytes sent","bytes_sent":5908,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-08T02:18:39","last_seen":"2026-09-27T22:21:36","events_24h":0,"events_7d":3,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Fremont","lat":37.5483,"lon":-121.9886,"asn":63949,"org":"Akamai Connected Cloud"},"source_domain":"us-west-6.astatine.li.prod.binaryedge.ninja","known_scanners":["binaryedge","BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[{"cve_id":"CVE-2025-0282","title":"Ivanti Connect Secure - Stack-based Buffer Overflow","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/dana-na/auth/url_default/welcome.cgi"}],"malware":[],"top_ports":[{"port":2443,"proto":"tcp","label":"","count":38},{"port":443,"proto":"tcp","label":"HTTPS","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i2511h2_b78ed14e2fd0_ab7e3b40a677","t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"16030105f4010005f00303fd5d3308de867233b9f573887e5237a8abcf8e635e91e98246cd6404c17a38c420ba4b177a407c6fc55f75e1bfecd82720096de851474ec8b3339b37d87143099f0032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000575000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a00180804040308070805080604010501060105030603020102030010000e000c02683208687474702f312e31002b0009080304030303020301003304ea04e811ec04c0c9427b51e8319852355439a3493324feab89b46c13d55c331933ad9661c01a8a0812f41cb5773769ccce40e258ffc34fbacbc407fc657af928f744bdf61a8ab6b8070c8793ed1484e2c45221b902e90c4bda85b911632d7d179ccd8402ca5a92ed09a7daa6ce6e8758f4518082665c45652430529aec0b640c5b88bd5bb0ec1abf1caa045b042862a79a17d5b1eb146c16300e1c5443c52833dffc7d37aa9181448615a94f39a16785998c1644bbd3318136b8bddd44022f9b0be70c7b121c458929238e5442f1d32881d87dd165c6451b8430d262f2f67081d5b2a2ea4a3eea7509f419e0a6289fe70cb51740fe3b3c9275b530d0a759893763124de7acc10c867b230cb2e3f5af760ca22c58a2e5b3ceaa17a6ad4364cd46ce64e4bc4ed2706ea84588168ca1856ef51078ab10a36cd821f8d28e10235f86e00600622ff0287aaa1211004067acd99daf395bfc11a3cf8535e5f73967593d5e268da789354ed058f6b713f7476d3a9749492139de424c08908c84da71ec7b10c9ea3f1c700870390d9fba2c8f2775b68a753ec612dd4c74c95a11b8883555450a03f2813a175344698a6db596fad378d7eb07ff0665ce1268eb2699a3a37e28541e6bd132cfa425b3363f7eb3a65cbb40afac5af5cbc9105742791945e0a21a32ca8f348c658470314b2b34debbb8db27a1b1d8c9de913460cb8e056c2ffb6546f8e5b918b951e34863f258387a5b0de352849839af3c8b9e95b53561d21428bb94d8a44d11f40ee1a48fc07914a9452fa6f592089a79ae108c6f9a6e1588aba652645191618d4a4766d333481a2fd0c3b561b4174a0ab578889409dc8475f546d9f7c14ac45268d39ef1b9055ab11ff7d46849da4e011bbac135a780a7cd57bab78fcc2bb2c38a5953642254144065c6f5f06f7bd9564210009b266881b45f99c5705cc26e00f10fe2906140f1a58f3324ea821bf3ec036c899f51735384ecc2c5934b66e347285bb5aa73cad635bc3ee2c1e89b6cf61464436a8544d06ae2332e4a11846ad93f84016face06ea94c7d49511988814658990813da9123ea597c522fe5e4bdf8d0169e70a43ec329d1751e8fec9194b944cbdb55b762059312137305672f7cbe3c1c83df1806c6431d0545bdc06c91d40034d4802de5068d2ba62b9df294288acb81019de9fc12a04a4ea1f87b6547936a572e28f1cdc8a122790a6254c46bb0f815382072c1464e2a1556a80b598552a3e7d2b07599c6928963e06cae6a4704b161ae55390096e614d599ae2141501c669ff1517ca52c5e16cc29d3d087545cce2780940fb7cf57c458c01371fa220d5cfb1d94dcb110da0bab0c716238263b207818614af3ab5f87f9853514143ba1cc547592d7343c692553ea0759c091bf2f7163abbb8b5b8321e7f8290239bf89ba1d75220a8f7946617883bd70bff7d707c81a9e4e3374b5f913cd0635b3a84eb038b57ae109a0a38fbd729e9353c4f49a2bec470084ea0b52ca966ba81fb4bbc9e0eb68e09031235b4f1fa38abc09a94b435935e2274f70834103492bf5248a9435caf289c75b7f197925a4e8167e455c52d7a6b7d6479929667c4ba2ea939c79714fdc53b36d516ac2b722e4d97102ee13f1e94b1db084e21e5ce7b9485e1bcd95a2f3383ca928eeba1e21eb2e588bf807da5942f729696e89518a14acb8095680f58f826750b553f05824d6497b001d00208bf807da5942f729696e89518a14acb8095680f58f826750b553f058","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d","f20f35624b79af10f537cb4e1e40197e"],"http_akin":["a11cun040_0000004e_608dab68"]},"fingerprint_peers":{"t13i2511h2_b78ed14e2fd0_ab7e3b40a677":93,"t13i311000_e8f1e7e78f70_d41ae481755e":807,"a11cun040_0000004e_608dab68":811},"akin_families":{"a11cun040_0000004e_608dab68":{"head":"a11cun040_0000004e_608dab68","shapes":2,"ips":811}},"user_agents":["Go-http-client/1.1","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36"],"timeline":[{"date":"2026-09-08","count":1},{"date":"2026-09-13","count":38},{"date":"2026-09-27","count":3}],"recent_events":[{"timestamp":"2026-09-27T22:21:36","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dana-na/auth/url_default/welcome.cgi","summary":"","payload_hex":"474554202f64616e612d6e612f617574682f75726c5f64656661756c742f77656c636f6d652e63676920485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"8b4782f7-b901-4458-a3bf-21e3fcf84a7f","seq":1,"duration_ms":100,"bytes_in":253,"bytes_out":79},{"timestamp":"2026-09-27T22:21:35","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dana-na/nc/nc_gina_ver.txt","summary":"","payload_hex":"474554202f64616e612d6e612f6e632f6e635f67696e615f7665722e74787420485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"2ad54b43-49c7-4ba8-996b-10f7e21f8595","seq":1,"duration_ms":101,"bytes_in":243,"bytes_out":79},{"timestamp":"2026-09-27T22:21:35","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/dana-cached/hc/HostCheckerInstaller.osx","summary":"","payload_hex":"474554202f64616e612d6361636865642f68632f486f7374436865636b6572496e7374616c6c65722e6f737820485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313539205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","ja3":"f20f35624b79af10f537cb4e1e40197e","session":"c74a344e-2f21-410a-9db9-da30c71f6cc7","seq":1,"duration_ms":101,"bytes_in":256,"bytes_out":79},{"timestamp":"2026-09-13T11:03:32","port":2443,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001I20100\n","payload_hex":"014932303130300a","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"bef45cc6-fd73-4971-bf04-9a8a45139c57","seq":1,"duration_ms":246,"bytes_in":8,"bytes_out":14,"enriched":{"digest":"14b0bf5196552d7e","strings":["I20100"]}},{"timestamp":"2026-09-13T11:03:30","port":2443,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"f61ff2d4-9fdf-427d-a4ef-57f3841fd2a0","seq":1,"duration_ms":246,"bytes_in":5,"bytes_out":14},{"timestamp":"2026-09-13T11:03:27","port":2443,"proto":"tcp","app_proto":"tls","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d41646d696e6973747261746f720d0a0100080000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"37f5278d-24c5-4372-9654-09d8dbaefd1f","seq":1,"duration_ms":246,"bytes_in":51,"bytes_out":14,"enriched":{"digest":"56a8af4f4fb4faa0","label":"RDP (X.224)","strings":["Cookie: mstshash=Administrator"]}},{"timestamp":"2026-09-13T11:03:25","port":2443,"proto":"tcp","app_proto":"tls","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000FINDSCU\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000:Q\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\u001e1.2.826.0.1.3680043.2.1396.999U\u0000\u0000\fCharruaVista","payload_hex":"0100000000cd00010000414e592d53435000000000000000000046494e44534355000000000000000000000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100000030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000003a51000004000040005200001e312e322e3832362e302e312e333638303034332e322e313339362e3939395500000c436861727275615669737461","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"7a2b9d23-6c32-40f1-8cb2-ae0001a1fc89","seq":1,"duration_ms":246,"bytes_in":211,"bytes_out":14,"enriched":{"digest":"14f9c94d13e59316","label":"DICOM","strings":["ANY-SCP","FINDSCU","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.826.0.1.3680043.2.1396.999U","CharruaVista","ANY-SCPFINDSCU","1.2.840.10008.3.1.1.1 .","1.2.840.10008.1.2P:Q"]}},{"timestamp":"2026-09-13T11:03:23","port":2443,"proto":"tcp","app_proto":"tls","app_protocol":"iscsi","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003�\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000AuthMethod=None\u0000\u0000","payload_hex":"038100000000005f40000137000000000000000100010000000000010000000100000000000000000000000000000000496e69746961746f724e616d653d69716e2e313939312d30352e636f6d2e6d6963726f736f66743a6265696f2d69736373692d70726f62650053657373696f6e547970653d446973636f7665727900417574684d6574686f643d4e6f6e650000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"ea0378c6-47e7-4ba3-be66-ffdc0353edbf","seq":1,"duration_ms":246,"bytes_in":144,"bytes_out":14,"enriched":{"digest":"482810f8d0264f72","label":"iSCSI","strings":["InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe","SessionType=Discovery","AuthMethod=None","InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probeSessionType=DiscoveryAut…"],"iocs":{"domains":["iqn.1991-05.com.microsoft"]}}},{"timestamp":"2026-09-13T11:03:21","port":2443,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000","payload_hex":"000000010000000100000004000000080000000100000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"8cc8a255-8b23-4b6d-9d88-74d8924882ca","seq":1,"duration_ms":246,"bytes_in":24,"bytes_out":14},{"timestamp":"2026-09-13T11:03:19","port":2443,"proto":"tcp","app_proto":"tls","app_protocol":"pptp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000�\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001��\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000beio\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"009c00011a2b3c4d00010000010000000000000100000001ffff00016e6f6e650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006265696f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"dc075499-0568-47c5-bbdc-4833c1278865","seq":1,"duration_ms":243,"bytes_in":156,"bytes_out":14,"enriched":{"digest":"3415c4d31123c5ba","strings":["none","beio","nonebeio"]}}],"http_methods":[{"method":"GET","count":5},{"method":"POST","count":1},{"method":"OPTIONS","count":1}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":2,"ports":1},{"path":"/sdk","count":1,"ports":1},{"path":"/dana-na/nc/nc_gina_ver.txt","count":1,"ports":1},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":1,"ports":1},{"path":"/dana-na/auth/url_default/welcome.cgi","count":1,"ports":1},{"path":"/dana-cached/hc/HostCheckerInstaller.osx","count":1,"ports":1}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":3}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[{"tag_id":"CVE-2025-0282","tag_type":"cve","title":"Ivanti Connect Secure - Stack-based Buffer Overflow","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/dana-na/auth/url_default/welcome.cgi","reference_urls":["https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283","https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/","https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","https://nvd.nist.gov/vuln/detail/CVE-2025-0282"]}],"data_as_of":"2026-09-29T14:02:36.367291+00:00"}