{"ip":"96.126.96.77","total_events":67,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"BinaryEdge","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (BinaryEdge).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"2,947 bytes sent","bytes_sent":2947,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-30T16:53:21","last_seen":"2026-09-02T16:43:18","events_24h":37,"events_7d":67,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Fremont","lat":37.5483,"lon":-121.9886,"asn":63949,"org":"Akamai Connected Cloud"},"source_domain":"us-west-46.beryllium.li.prod.binaryedge.ninja","known_scanners":["BinaryEdge"],"scanner_tag":{"key":"binaryedge","label":"BinaryEdge","category":"commercial","url":"https://www.binaryedge.io/"},"cve_matches":[],"malware":[],"top_ports":[{"port":49154,"proto":"tcp","label":"","count":37},{"port":5200,"proto":"tcp","label":"","count":30}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"ja4h":["ge10nn0000_000000000000","op10nn0000_000000000000"]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":1553,"ge10nn0000_000000000000":2930,"op10nn0000_000000000000":1970},"user_agents":[],"timeline":[{"date":"2026-08-30","count":30},{"date":"2026-09-02","count":37}],"recent_events":[{"timestamp":"2026-09-02T16:43:18","port":49154,"proto":"tcp","app_proto":"tls","app_protocol":"corba","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000","payload_hex":"47494f500100010024000000000000000100000001000000060000006162636465660000040000006765740000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"6652eabc-c900-4cae-9755-de875e1d8628","seq":1,"duration_ms":257,"bytes_in":48,"bytes_out":12,"enriched":{"digest":"2172ddff8435bc68","label":"CORBA (GIOP)","strings":["GIOP","abcdef"]}},{"timestamp":"2026-09-02T16:43:16","port":49154,"proto":"tcp","app_proto":"tls","app_protocol":"afp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000","payload_hex":"000300010000000000000002000000000f00","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"ec85796b-4468-4d5e-931b-f404d4aa1822","seq":1,"duration_ms":253,"bytes_in":18,"bytes_out":12},{"timestamp":"2026-09-02T16:43:14","port":49154,"proto":"tcp","app_proto":"tls","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004�\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000","payload_hex":"1201003400000000000015000601001b000102001c000c0300280004ff080001550000004d5353514c53657276657200480f0000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"83b718e9-2080-47d8-8adc-88374dc23311","seq":1,"duration_ms":259,"bytes_in":52,"bytes_out":12,"enriched":{"digest":"9852857ade38ccb3","strings":["MSSQLServer","UMSSQLServerH"]}},{"timestamp":"2026-09-02T16:43:11","port":49154,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000�\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004�\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))","payload_hex":"005a0000010000000136012c000008007fff7f08000000010020003a00000000000000000000000000000004e600000001000000000000000028434f4e4e4543545f444154413d28434f4d4d414e443d76657273696f6e2929","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"0a2c2ca5-d6fd-4520-a80c-9b340d5e5979","seq":1,"duration_ms":253,"bytes_in":89,"bytes_out":12,"enriched":{"digest":"021ae4ed85d78c7b","strings":["(CONNECT_DATA=(COMMAND=version))"]}},{"timestamp":"2026-09-02T16:43:09","port":49154,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000���\u000b��\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000����\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000/\u00009\u0000.\u0000\u0000.\u0000\u0000.\u0002\u00009\u00008\u0000\u0000;\u0000 \u0000{\u0000\u0000\u0000\u0000\u0000A\u0000A\u0000\u0000\u0000-\u0000\u0000A\u0000\u0000\u0000-\u0000\u0000\u0000a\u0000\u0000-\u0000A\u0000A\u0000\u0000A\u0000-\u0000\u0000\u0000\u0000\u0000A\u0000\u0000A\u0000A\u0000\u0000A\u0000A\u0000\u0000}\u0000\u0000\u0000�m�_","payload_hex":"010000fdcefa0bb0a00000004d4d53140000000000000000000000000000001200000001000300f0f0f0f00b0004001c0003004e00530050006c0061007900650072002f0039002e00002e00002e020039003800003b0020007b00000000004100410000002d0000410000002d0000006100002d00410041000041002d0000000000410000410041000041004100007d000000e06ddf5f","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"38c09949-0c99-4cfe-b0c1-24f4068fb147","seq":1,"duration_ms":254,"bytes_in":151,"bytes_out":12,"enriched":{"digest":"44194845022cae28","strings":["NSPlayer/9...","98; {AA-A-a-AAA-AAAAA}"]}},{"timestamp":"2026-09-02T16:43:07","port":49154,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"JRMI\u0000\u0002K","payload_hex":"4a524d4900024b","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"5d82b5a5-ec38-4804-a661-af639c02e727","seq":1,"duration_ms":260,"bytes_in":7,"bytes_out":12,"enriched":{"digest":"520dae2bdcec9072","strings":["JRMI"]}},{"timestamp":"2026-09-02T16:43:05","port":49154,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":":\u0000\u0000\u0000/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3a0000002f00000002000040020f0001003d050000000000000000000000002f000000000000000000401f0000000000000000000000000000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"f3842737-9505-43dd-b58c-10639b3fa870","seq":1,"duration_ms":252,"bytes_in":60,"bytes_out":12},{"timestamp":"2026-09-02T16:43:03","port":49154,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000�\u0001�\u0013","payload_hex":"446d6454000000170000000100000000111100ff01ff13","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"86c3476f-cb05-4c7f-a0e5-c9115443ee9c","seq":1,"duration_ms":253,"bytes_in":23,"bytes_out":12,"enriched":{"digest":"2198932494d130c5","strings":["DmdT"]}},{"timestamp":"2026-09-02T16:43:00","port":49154,"proto":"tcp","app_proto":"tls","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u000b\u0006�\u0000\u0000\u0000\u0000\u0000","payload_hex":"0300000b06e00000000000","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"4c671d9d-f9fb-4459-8fe2-a6b3d77956ca","seq":1,"duration_ms":256,"bytes_in":11,"bytes_out":12,"enriched":{"digest":"c6ea7c5d89294245","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-02T16:42:58","port":49154,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"TNMP\u0004\u0000\u0000\u0000TNME\u0000\u0000\u0004\u0000","payload_hex":"544e4d5004000000544e4d4500000400","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"f890325e-0325-4010-a2f2-83b6e0ee605f","seq":1,"duration_ms":252,"bytes_in":16,"bytes_out":12,"enriched":{"digest":"5a85151d1216831b","strings":["TNMP","TNME"]}}],"http_methods":[{"method":"GET","count":6},{"method":"OPTIONS","count":4}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":8,"ports":2},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":2,"ports":2}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-02T23:11:22.518204+00:00"}