{"ip":"96.126.96.45","total_events":337,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"binaryedge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (binaryedge).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"31,401 bytes sent","bytes_sent":31401,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-27T11:56:15","last_seen":"2026-09-28T23:06:39","events_24h":0,"events_7d":146,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Fremont","lat":37.5483,"lon":-121.9886,"asn":63949,"org":"Akamai Connected Cloud"},"source_domain":"us-west-14.beryllium.li.prod.binaryedge.ninja","known_scanners":["binaryedge","BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":49152,"proto":"tcp","label":"","count":47},{"port":50050,"proto":"tcp","label":"","count":47},{"port":9200,"proto":"tcp","label":"Elastic","count":46},{"port":32764,"proto":"tcp","label":"","count":46},{"port":95,"proto":"tcp","label":"","count":46},{"port":11214,"proto":"tcp","label":"","count":46},{"port":8889,"proto":"tcp","label":"","count":25},{"port":9633,"proto":"tcp","label":"","count":12},{"port":3308,"proto":"tcp","label":"","count":3},{"port":3359,"proto":"tcp","label":"","count":3},{"port":3352,"proto":"tcp","label":"","count":3},{"port":3370,"proto":"tcp","label":"","count":3},{"port":3363,"proto":"tcp","label":"","count":3},{"port":3391,"proto":"tcp","label":"","count":3},{"port":6000,"proto":"tcp","label":"X11","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"1603010200010001fc030305841d43d6a0eb4f1e03dd48a6e2a0b6b016071cb84acffc7ee0a027b3a7734d00003e130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000195000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d0020c935bd31bc5992779ca3930ec86eb3bcfbe2dd120b0a6c87e83c685cba03a96d001500fc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"http_akin":["a10lun000_00000000_334359b9"]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":799,"a10lun000_00000000_334359b9":800},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-27","count":46},{"date":"2026-08-30","count":3},{"date":"2026-09-01","count":12},{"date":"2026-09-04","count":6},{"date":"2026-09-06","count":46},{"date":"2026-09-15","count":4},{"date":"2026-09-16","count":25},{"date":"2026-09-17","count":47},{"date":"2026-09-22","count":2},{"date":"2026-09-24","count":93},{"date":"2026-09-25","count":47},{"date":"2026-09-27","count":3},{"date":"2026-09-28","count":3}],"recent_events":[{"timestamp":"2026-09-28T23:06:39","port":3370,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080000000000","method":"","user_agent":"","ja3":"","session":"de96cbeb-f7f4-4bdb-b70c-fb980101ed28","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"b481beafe15f409a","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-28T23:06:38","port":3370,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"eb2e7607-4121-48af-83ae-9ff4edbeb584","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-28T23:06:38","port":3370,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"740fd5d0-67fe-43d8-a6bb-95dfc87b5958","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-27T19:23:16","port":3352,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080002000000","method":"","user_agent":"","ja3":"","session":"a938714e-d00a-44b8-8e5c-284b569f6451","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"4986e56a8738b201","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-27T19:23:16","port":3352,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080001000000","method":"","user_agent":"","ja3":"","session":"3eb09f7c-c117-4936-9a73-51f701210a1d","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"af9b397590d28773","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-27T19:23:16","port":3352,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"030000130ee000000000000100080000000000","method":"","user_agent":"","ja3":"","session":"ca517cf9-8d3a-481c-86ae-bfc54cc25f61","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"b481beafe15f409a","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-25T01:04:09","port":49152,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001I20100\n","payload_hex":"014932303130300a","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"2a3b96cc-99d9-4747-a1e3-64e074867793","seq":1,"duration_ms":150,"bytes_in":8,"bytes_out":12,"enriched":{"digest":"14b0bf5196552d7e","strings":["I20100"]}},{"timestamp":"2026-09-25T01:04:08","port":49152,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"6c501e8c-2791-4b18-8ff8-6f066b15654b","seq":1,"duration_ms":148,"bytes_in":5,"bytes_out":12},{"timestamp":"2026-09-25T01:04:06","port":49152,"proto":"tcp","app_proto":"tls","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d41646d696e6973747261746f720d0a0100080000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"0680d2f0-072e-4733-ae1b-b744e9572838","seq":1,"duration_ms":148,"bytes_in":51,"bytes_out":12,"enriched":{"digest":"56a8af4f4fb4faa0","label":"RDP (X.224)","strings":["Cookie: mstshash=Administrator"]}},{"timestamp":"2026-09-25T01:04:04","port":49152,"proto":"tcp","app_proto":"tls","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\u0000�\u0000\u0001\u0000\u0000ANY-SCP\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000FINDSCU\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000:Q\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\u001e1.2.826.0.1.3680043.2.1396.999U\u0000\u0000\fCharruaVista","payload_hex":"0100000000cd00010000414e592d53435000000000000000000046494e44534355000000000000000000000000000000000000000000000000000000000000000000000000000000000010000015312e322e3834302e31303030382e332e312e312e312000002e0100000030000011312e322e3834302e31303030382e312e3140000011312e322e3834302e31303030382e312e325000003a51000004000040005200001e312e322e3832362e302e312e333638303034332e322e313339362e3939395500000c436861727275615669737461","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"559a7720-f121-4afc-bde5-0eb6e146ac6e","seq":1,"duration_ms":148,"bytes_in":211,"bytes_out":12,"enriched":{"digest":"14f9c94d13e59316","label":"DICOM","strings":["ANY-SCP","FINDSCU","1.2.840.10008.3.1.1.1","1.2.840.10008.1.1@","1.2.840.10008.1.2P","1.2.826.0.1.3680043.2.1396.999U","CharruaVista","ANY-SCPFINDSCU","1.2.840.10008.3.1.1.1 .","1.2.840.10008.1.2P:Q"]}}],"http_methods":[{"method":"GET","count":22},{"method":"OPTIONS","count":13}],"distinct_ports_total":18,"top_paths":[{"path":"/","count":27,"ports":8},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":8,"ports":7}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T03:54:41.428316+00:00"}