I found the following strange HTTP request apparently emanating from binaryedge.ninja:

 min-li-ustx-12-13-65991-x-prod.binaryedge.ninja - - [05/Jan/2020:07:18:48 -0500] "GET / HTTP/1.0" 302 212 "-" "-"
 min-extra-grab-108-ustx-prod.binaryedge.ninja - - [05/Jan/2020:07:18:52 -0500] "GET / HTTP/1.0" 302 212 "-" "-"
 min-extra-grab-108-ustx-prod.binaryedge.ninja - - [05/Jan/2020:07:18:54 -0500] "HELP" 400 226 "-" "-"
 min-extra-grab-108-ustx-prod.binaryedge.ninja - - [05/Jan/2020:07:18:54 -0500] "\x1b\x84\xd5\xb0]\xf4\xc4\x93\xc50\xc2X\x8c\xda\xb1\xd7\xac\xafn\x1d\xe1\x1e\x1a3*\x85\xb7\x1d'\xb1\xc9k\xbf\xf0\xbc" 400 226 "-" "-"
 min-extra-grab-108-ustx-prod.binaryedge.ninja - - [05/Jan/2020:07:18:56 -0500] "\x16\x03\x01" 400 226 "-" "-"
 min-extra-grab-108-ustx-prod.binaryedge.ninja - - [05/Jan/2020:07:18:58 -0500] "\xbd\xff\x9e\xffE\xff\x9e\xff\xbd\xff\x9e\xff\xa4\xff\x86\xff\xc4\xff\xbe\xff\xc7\xff\xdb\xff\xee\xffx\\d9\xff\xed\xff\xa4\xff\x9d\xff\xcf\xff\xd8\xff\xe5\xff\x04\xff\x12\xff0\xff\xb1\xff\xbd\xff\xe7\xff\xe2\xff\xdd\xff\xdc\xff\xde\xff\xc8\xff\xcc\xff\xbe\xff\xf8\xff&\xff\x01\xff\x0f\xff\xf5\xff\x06\xff\xff\xff\xf7\xff!\xff\xde\xff\x02\xff&\xff\x0c\xff\x01\xff\xf5\xff" 400 226 "-" "-"

Looking around the web, I see similar log messages on other publicly visible web logs and one suggesting some connection to Gh0st.

Anyone have any idea what this is, and by this company would appear to be attacking my server and others?

  • 2
    "\x16\x03\x01" is the beginning of a TLS handshake message, but it is cut off. Jan 8 '20 at 21:47
  • Binary Edge 'scan the internet and acquire data that can be transformed into threat intelligence feeds or security reports'.
    – LTPCGO
    Jan 9 '20 at 1:18
  • I'm not sure what you are looking for. Their homepage explains everything ...
    – schroeder
    Jan 16 '20 at 15:44
  • The homepage says that they scan the Internet. My question is what exactly is this scan attempting to do? (perhaps I should make this more clear in the question) Jan 17 '20 at 16:03

The company isn't 'attacking' your servers, rather it's just part of a scan that the company provides as a service to it's customers.

On their website they claim they "scan the entire public internet to create real-time threat intelligence streams...bla bla bla". Basically they scan the internet, and provide the data to their customers.

These logs are probably just the result of them trying to scan whatever HTTP things you've got on your server.

Nobody likes having their server being poked at by a unknown third-party, sometimes you can reach out to these scanning services to get your IP removed from the scanned results -- not sure how effective that's going to be though.

  • I realize that this is a scan ... the question is what type of scan is it? What exactly are they doing with their hex? Jan 17 '20 at 16:02
  • 1
    The hex you see is probably an HTTPS request sent to your HTTP port.
    – ThoriumBR
    Jan 20 '20 at 20:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.