{"ip":"18.97.19.196","total_events":79,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"crowdstrikefalconsurface","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (crowdstrikefalconsurface).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,165 bytes sent","bytes_sent":6165,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-17T13:53:54","last_seen":"2026-09-24T17:32:12","events_24h":0,"events_7d":16,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Ashburn","lat":39.0469,"lon":-77.4903,"asn":14618,"org":"Amazon.com, Inc."},"source_domain":"scanner-18-97-19-196.reposify.net","known_scanners":["crowdstrikefalconsurface","Reposify (CrowdStrike)"],"scanner_tag":{"key":"reposify","label":"Reposify (CrowdStrike)","category":"commercial","url":"https://www.crowdstrike.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":5432,"proto":"tcp","label":"Postgres","count":13},{"port":21,"proto":"tcp","label":"FTP","count":12},{"port":443,"proto":"tcp","label":"HTTPS","count":12},{"port":5601,"proto":"tcp","label":"Kibana","count":10},{"port":5000,"proto":"tcp","label":"Web-alt","count":10},{"port":830,"proto":"tcp","label":"","count":3},{"port":389,"proto":"tcp","label":"LDAP","count":3},{"port":1337,"proto":"tcp","label":"","count":3},{"port":1200,"proto":"tcp","label":"","count":3},{"port":26,"proto":"tcp","label":"","count":2},{"port":50090,"proto":"tcp","label":"","count":2},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":2},{"port":8086,"proto":"tcp","label":"InfluxDB","count":1},{"port":8889,"proto":"tcp","label":"","count":1},{"port":137,"proto":"tcp","label":"NetBIOS","count":1}],"fingerprints":{"ssh_hassh":["d6729b7f24428169e981ad4840063ca5"],"tls_ja4":["t13i4311h1_c7886603b240_b26ce05bbdd6","t13d041000_16476d049b0b_78f1d400d464","t13i3612h1_bcee18a5b459_8537cf56674e"],"tls_client_hello":"16030100e8010000e4030336e0c3bdf8becb72beaca84a140d2839ccd083a92c50da5c0d6c0ae57511d3932081a038f4c807fa59a2d36556dd38f55fff017e485a2e0f516b72104c342f0ee7000813021303130100ff0100009300000012001000000d3139322e332e3131382e313436000b000403000102000a000c000a001d0017001e00190018002300000016000000170000000d001e001c040305030603080708080809080a080b080408050806040105010601002b0003020304002d00020101003300260024001d0020983ddac6525fd2bfa40d7e98fe8c11f522e8c4d3ab73aa6e66805d6993cfbb74","tls_ja3":["d18b223ce817c861b7829130500395c2","a66e498c488aa0523759691248cdfb01"],"http_akin":["a11cun050_0000004f_94db1cf7","a11cun050_0000004f_0d8a8ff5"]},"fingerprint_peers":{"t13i4311h1_c7886603b240_b26ce05bbdd6":15,"t13d041000_16476d049b0b_78f1d400d464":130,"t13i3612h1_bcee18a5b459_8537cf56674e":306,"d6729b7f24428169e981ad4840063ca5":135,"a11cun050_0000004f_94db1cf7":121,"a11cun050_0000004f_0d8a8ff5":533},"akin_families":{"a11cun050_0000004f_94db1cf7":{"head":"a11cun050_0000004f_0d8a8ff5","shapes":2,"ips":533},"a11cun050_0000004f_0d8a8ff5":{"head":"a11cun050_0000004f_0d8a8ff5","shapes":2,"ips":533}},"user_agents":["Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/53.0.3029.70 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/51.0.3075.62 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/52.0.3052.62 Safari/537.32","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","elasticsearch-py/7.13.4 (Python 3.10.21)","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/55.0.3037.86 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/54.0.3001.77 Safari/537.32"],"timeline":[{"date":"2026-07-12","count":1},{"date":"2026-07-27","count":1},{"date":"2026-07-31","count":2},{"date":"2026-08-30","count":1},{"date":"2026-09-05","count":3},{"date":"2026-09-07","count":2},{"date":"2026-09-24","count":16}],"recent_events":[{"timestamp":"2026-09-24T17:32:12","port":137,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000\u0000","payload_hex":"81000000","method":"","user_agent":"","ja3":"","session":"e4a6abcf-a9ac-4233-9c69-9e20d8263cf6","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":12},{"timestamp":"2026-09-24T12:35:01","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0003\u0001\u0000\u0002\u0002P","payload_hex":"15030100020250","method":"","user_agent":"","ja3":"","session":"ca5121a6-9f06-4da1-9de1-6e909dba7e36","seq":1,"duration_ms":0,"bytes_in":7,"bytes_out":12},{"timestamp":"2026-09-24T12:34:58","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0003\u0001\u0000\u0002\u0002P","payload_hex":"15030100020250","method":"","user_agent":"","ja3":"","session":"a7960342-5f82-44cb-b831-4331507f99d7","seq":1,"duration_ms":0,"bytes_in":7,"bytes_out":12},{"timestamp":"2026-09-24T12:34:57","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0005\u0000� �����Ef+\u0013�\u000e��ԝ","payload_hex":"801c01000200030000001005008020eab5f0a8e345662b13f00ecff5d49d","method":"","user_agent":"","ja3":"","session":"25f089ab-3f57-48ca-93fa-874ab43f7429","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":12},{"timestamp":"2026-09-24T12:34:52","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0002\u0000��Df�Z�<a4j����K!","payload_hex":"801c010002000300000010020080e54466f45a903c61346aaa90b5a34b21","method":"","user_agent":"","ja3":"","session":"8f5a7cc2-528d-47c2-ab27-ba2d5d0ce3db","seq":1,"duration_ms":101,"bytes_in":30,"bytes_out":12,"enriched":{"digest":"b24808b368769905","strings":["<a4j"]}},{"timestamp":"2026-09-24T12:34:52","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0007\u0000���,\u0003�T�\u0011\u0007=zW����","payload_hex":"801c0100020003000000100700c0a4e42c03bc548e11073d7a578dc3fecc","method":"","user_agent":"","ja3":"","session":"3a440031-dfb1-45ed-b59a-a119861ce0e8","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":12},{"timestamp":"2026-09-24T12:34:47","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0003\u0000���\u0002�\u0017X�A*viW�\u0001\u0015�","payload_hex":"801c010002000300000010030080c3f602b91758f9412a766957d10115cc","method":"","user_agent":"","ja3":"","session":"4bfc7999-8450-47b6-97ab-5c062d06a4a6","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":12,"enriched":{"digest":"7c74765349208fb4","strings":["A*viW"]}},{"timestamp":"2026-09-24T12:34:47","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0001\u0000�2p�|&���q�k'�&��","payload_hex":"801c0100020003000000100100803270fe7c26fc8ce271e56b27a02697c2","method":"","user_agent":"","ja3":"","session":"3ed49e2d-7076-4de5-b2f1-cb7b6d2013b1","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":12},{"timestamp":"2026-09-24T12:34:42","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0004\u0000�3�\u00026GmJ\u0003\u001f��#��n?","payload_hex":"801c01000200030000001004008033ad0236476d4a031fa3cd2381fd6e3f","method":"","user_agent":"","ja3":"","session":"ec71b3f7-4325-4c1b-b244-a17c58d65c51","seq":1,"duration_ms":101,"bytes_in":30,"bytes_out":12,"enriched":{"digest":"4bb894b908ac0153","strings":["6GmJ"]}},{"timestamp":"2026-09-24T12:34:42","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0006\u0000@�­o��Q$��ZomG��","payload_hex":"801c010002000300000010060040efc2ad6fd8e6512495c55a6f6d47a7c3","method":"","user_agent":"","ja3":"","session":"1d994acb-330d-420f-a97d-d1ddae8ac4b6","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":12,"enriched":{"digest":"d88c048b878490b7","strings":["ZomG"]}}],"http_methods":[{"method":"GET","count":25}],"distinct_ports_total":16,"top_paths":[{"path":"/","count":23,"ports":15},{"path":"/_alias","count":1,"ports":1},{"path":"/*","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[{"value":"localhost","count":1}],"top_alpns":[{"value":"http/1.1","count":6}],"banners":[{"value":"SSH-2.0-paramiko_2.9.2","count":2}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-29T14:56:48.573676+00:00"}