{"ip":"18.97.19.252","total_events":86,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"crowdstrikefalconsurface","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (crowdstrikefalconsurface).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,489 bytes sent","bytes_sent":5489,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-19T17:27:19","last_seen":"2026-09-23T06:55:18","events_24h":2,"events_7d":2,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Ashburn","lat":39.0469,"lon":-77.4903,"asn":14618,"org":"Amazon.com, Inc."},"source_domain":"scanner-18-97-19-252.reposify.net","known_scanners":["crowdstrikefalconsurface","Reposify (CrowdStrike)"],"scanner_tag":{"key":"reposify","label":"Reposify (CrowdStrike)","category":"commercial","url":"https://www.crowdstrike.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":5222,"proto":"tcp","label":"XMPP","count":13},{"port":5000,"proto":"tcp","label":"Web-alt","count":12},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":11},{"port":9191,"proto":"tcp","label":"","count":11},{"port":2096,"proto":"tcp","label":"","count":11},{"port":10443,"proto":"tcp","label":"","count":10},{"port":10001,"proto":"tcp","label":"","count":3},{"port":9868,"proto":"tcp","label":"","count":2},{"port":9869,"proto":"tcp","label":"","count":2},{"port":9871,"proto":"tcp","label":"","count":2},{"port":50065,"proto":"tcp","label":"","count":2},{"port":8085,"proto":"tcp","label":"","count":1},{"port":8081,"proto":"tcp","label":"","count":1},{"port":2078,"proto":"tcp","label":"","count":1},{"port":666,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":["d6729b7f24428169e981ad4840063ca5"],"tls_ja4":["t13i4311h1_c7886603b240_b26ce05bbdd6","t13d041000_16476d049b0b_78f1d400d464","t13i3612h1_bcee18a5b459_8537cf56674e"],"tls_client_hello":"16030106130100060f03037d898eecb35b19fa580af3f48e0dbfc648c4dc36ce30e5356cf29b2cb59fa8bb20c081ab27fc1ef239cb8eab7d75c4bf437737779571dd2c42566d75869390f9030048130213031301c02cc030c02bc02fcca9cca8009f009eccaac0adc0acc024c028c023c027c00ac014c009c013c09fc09e006b006700390033009d009cc09dc09c003d003c0035002f0100057eff01000100000b000403000102000a0012001011ec001d0017001e00180019010001010010000b000908687474702f312e31001600000017000000310000000d0036003409050906090404030503060308070808081a081b081c0809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003304ea04e811ec04c04cc8bc51506cc780a819ea924e15b4a7c70bc9a70639395edeb82d258c46d6d0587f748a772b5d98147ddf099e2b44070bfaad8a3c69de55610ac3c150a86ae8acc4cfbb75ca48ad9429ab80c49019a48ebb589cf946b7f2d217dee000d242b9b6eca9a5a29b25675e0919072a1904137bb2138ba817c05bdc467a994640080b9dcc10069bbc75bcb03648705f2e4b0457b90bf3741129280175d3156b42a3c38377df669c72c5a5d837ba0c612b09036451ec26626c86565ace41cacd735aac1ab011d6d98142fc000ff0b2e31a53d0f6bbd8b7a5fc575462e2ca2ca1628ae025e3f53bd7cc5329b47f0a05882e10300740484cc3c9615468a95b7988070adf8b8ec911c1af44788381ce46b671c8f2818a453215159f012a91ad4364ccd42338849e2d64094c1121ad68917194bb73c54528f99020b502a47b526c423f14bc6461065b41fa8c53c6b789136e859a0fbc93baa5a17730163e5644b97d157eab7345a5e7ccd5e2a71bfa9f5c27a3c1166b9ff26a8b31a7fa9c82903362f6c51f1337875052c70c7a54e2eb76f309acb314932fd68af3d6759b4a0e29fb04a8f5603f2a4d1c4596a2ea53d17a3df0495bd1ba2efbda06ce33097235c3ecbac5b409568d662de359c849d079b5b06906a19cf427b7f0d35146e519d2368f65c24d25ab401d9225a8375bb9d01bcd87cdd39155e30781a3e210d33662b38a530ec08c732c65313578151a5482b16c7ff12db89681b287c21b4725451c5713719d8b843318e131903821be9247fb89383aa1698db76c357027bd6269785a9045d0792ec6a8655b65815c285d3bbb70428567231d7f5111399a5c39cbb975e422f2829e4e8a477844611755441e124b873a5c645591ea26bc303967f10cc0e4e3152f4b7e45fbaf9d9850c9a41873b4984bbb9ffc064099bb34be5ba9f3fb50f7ccc347a8431a0112d37710ae66349984a74c23ce4b3172ba35ac452332f4cc8c682551f8081b4fc54297923a5c0232669b2de6a612291b8894039882e5c719cc3c9e318789508f96ac6190953490a081189c48e90557a4f549a77021bb1b6bda25177c6c25f67480d2442d403481b1b165c28899c1f51d3301adc6f31cbed189f0c521f581165692a5b59135bf4628a72c170f47c6410098f9a822a37225595c0cc8271484a28b517b620e02c303ac05be503b8cb04ea25c1d83db301e6983a4f02f85c95bd7e770f27b84b124944cdb4af0fb0516331aa32525c6cac44eb30dcdb70179777fbbaab5cea6b4d358987b0a71b8c7923c6821a6a4c81f619405d8b6bd5c7931491cdca08472829113a4a9004538b4a53fa705013cf3494ff86abf088f02085bfa1a14b9d88892a77098429e3df770cba66db8925aeb8008e0898f87c369ca58265e3849d295a3fac47dd10c91f823cf136c6c8951156b084730004c1531583198c8a7339452431f59f1906ac2b922b46f67f513993704bc81b193f68766118e3c0868ebf48c5c774ef7645e03397da161a36ae8939b559c333ccaebe46585c0ae2fcbc3f0f323260422a32a7add310d879645b545280345cf740c2caca717fffc19d73bba6661ca7164951e08b0a500cb66a9b5217ab36b31990394ce636dfe219491c21ea1d404348511026d29f6c025b54ca3b5e87ad031df826315dd7eb381b7be860ba864440faeb80d241135d2a69e5dfd958e6117f24b9b3d15001d0020c70a5516daec6ba17b8771746d85a0686e86af40c23a2e2930e5f0f1bb9e4800001b000504000100","tls_ja3":["d18b223ce817c861b7829130500395c2","a66e498c488aa0523759691248cdfb01"],"http_akin":["a11cun121_0000e95f_b585e99d","a11cun050_0000004f_0d8a8ff5"]},"fingerprint_peers":{"a11cun121_0000e95f_b585e99d":4,"t13i3612h1_bcee18a5b459_8537cf56674e":297,"t13i4311h1_c7886603b240_b26ce05bbdd6":20,"t13d041000_16476d049b0b_78f1d400d464":124,"d6729b7f24428169e981ad4840063ca5":143,"a11cun050_0000004f_0d8a8ff5":97},"akin_families":{"a11cun050_0000004f_0d8a8ff5":{"head":"a11cun050_0000004f_0d8a8ff5","shapes":2,"ips":97}},"user_agents":["Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/57.0.3057.87 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3038.109 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/52.0.3070.51 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3046.95 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/53.0.3019.67 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/58.0.3063.84 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/55.0.3093.88 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/52.0.3090.111 Safari/537.32"],"timeline":[{"date":"2026-06-30","count":1},{"date":"2026-07-15","count":1},{"date":"2026-08-02","count":2},{"date":"2026-08-15","count":5},{"date":"2026-08-26","count":12},{"date":"2026-08-27","count":1},{"date":"2026-09-23","count":2}],"recent_events":[{"timestamp":"2026-09-23T06:55:18","port":9869,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"application/json, text/plain, */*; q=0.01\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"en-US,en;q=0.9\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"dnt\":\"1\",\"host\":\"localhost\",\"sec-fetch-dest\":\"document\",\"sec-fetch-mode\":\"navigate\",\"sec-fetch-site\":\"none\",\"sec-fetch-user\":\"?1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/58.0.3063.84 Safari/537.32\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e323b656e2d555329204170706c655765624b69742f3533372e33322e333620284b48544d4c2c206c697665204765636b6f29204368726f6d652f35382e302e333036332e3834205361666172692f3533372e33320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f706c61696e2c202a2f2a3b20713d302e30310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a5365632d46657463682d446573743a20646f63756d656e740d0a5365632d46657463682d4d6f64653a206e617669676174650d0a5365632d46657463682d536974653a206e6f6e650d0a5365632d46657463682d557365723a203f310d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a444e543a20310d0a486f73743a206c6f63616c686f73740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/58.0.3063.84 Safari/537.32","ja3":"d18b223ce817c861b7829130500395c2","session":"62d4d5f2-48a8-431c-ae81-0513bdfdf1f5","seq":1,"duration_ms":100,"bytes_in":430,"bytes_out":77},{"timestamp":"2026-09-23T06:55:18","port":9869,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9869\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3046.95 Safari/537.32\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393836390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e323b656e2d555329204170706c655765624b69742f3533372e33322e333620284b48544d4c2c206c697665204765636b6f29204368726f6d652f35392e302e333034362e3935205361666172692f3533372e33320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3046.95 Safari/537.32","ja3":"","session":"606343c1-d57f-4c87-9ebf-f8c6dd4b3eae","seq":1,"duration_ms":100,"bytes_in":237,"bytes_out":77},{"timestamp":"2026-08-27T20:23:42","port":8020,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8020\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/51.0.3112.102 Safari/537.32\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383032300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e323b656e2d555329204170706c655765624b69742f3533372e33322e333620284b48544d4c2c206c697665204765636b6f29204368726f6d652f35312e302e333131322e313032205361666172692f3533372e33320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/51.0.3112.102 Safari/537.32","ja3":"","session":"d769c13e-8d78-43d5-ac71-a32bb0d74a95","seq":1,"duration_ms":100,"bytes_in":238,"bytes_out":77},{"timestamp":"2026-08-26T16:56:19","port":5000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0003\u0001\u0000\u0002\u0002P","payload_hex":"15030100020250","method":"","user_agent":"","ja3":"","session":"941178e2-907a-478b-876a-e4fb34cc0bfb","seq":1,"duration_ms":0,"bytes_in":7,"bytes_out":12},{"timestamp":"2026-08-26T16:56:17","port":5000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0003\u0001\u0000\u0002\u0002P","payload_hex":"15030100020250","method":"","user_agent":"","ja3":"","session":"4ebc6098-cf02-4abb-b604-656dda3c9036","seq":1,"duration_ms":0,"bytes_in":7,"bytes_out":12},{"timestamp":"2026-08-26T16:55:41","port":5000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0007\u0000����\r�&\u001cA���y:z��","payload_hex":"801c0100020003000000100700c095f8b30de1261c41a99ee2793a7a88e9","method":"","user_agent":"","ja3":"","session":"c533780c-7e7c-473b-adc8-7707523b3883","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":12},{"timestamp":"2026-08-26T16:55:36","port":5000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0001\u0000�����^��@�\t�3��\u001e","payload_hex":"801c010002000300000010010080e9a6f4ea5ec4f04086098a7f33c7c81e","method":"","user_agent":"","ja3":"","session":"a81a3a25-fb69-4849-b159-fe6021bfabb4","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":12},{"timestamp":"2026-08-26T16:55:36","port":5000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0002\u0000�\u0019����N�3)�\u0002��Y\fd","payload_hex":"801c01000200030000001002008019f3b7fddb4ee53329eb02feaf590c64","method":"","user_agent":"","ja3":"","session":"48ad2277-429d-4f96-8fe9-37b685c0765d","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":12},{"timestamp":"2026-08-26T16:55:30","port":5000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0005\u0000�����f�\u001f�'V���\u0005��","payload_hex":"801c01000200030000001005008087b1c0a366ba1f942756cae0b605dec6","method":"","user_agent":"","ja3":"","session":"cae53544-d95f-4fc1-8b0d-e92b4f3740ff","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":12},{"timestamp":"2026-08-26T16:55:30","port":5000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0003\u0000� �\u0010\u001f9��$\u0001���6�\u0005�","payload_hex":"801c01000200030000001003008020a6101f39ea8e240196a59836e1058c","method":"","user_agent":"","ja3":"","session":"2de9ed6a-16b3-4f2c-894a-bbec809e1fcd","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":12}],"http_methods":[{"method":"GET","count":23}],"distinct_ports_total":18,"top_paths":[{"path":"/","count":23,"ports":17}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"localhost","count":4}],"top_alpns":[{"value":"http/1.1","count":10}],"banners":[{"value":"SSH-2.0-paramiko_2.9.2","count":1}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Cache-Control","Connection","Dnt","Host","Sec-Fetch-Dest","Sec-Fetch-Mode","Sec-Fetch-Site","Sec-Fetch-User","User-Agent"],"representative":[{"name":"Accept","value":"application/json, text/plain, */*; q=0.01","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate, br","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.9","notable":false},{"name":"Cache-Control","value":"no-cache","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Dnt","value":"1","notable":false},{"name":"Host","value":"localhost","notable":false},{"name":"Sec-Fetch-Dest","value":"document","notable":false},{"name":"Sec-Fetch-Mode","value":"navigate","notable":false},{"name":"Sec-Fetch-Site","value":"none","notable":false},{"name":"Sec-Fetch-User","value":"?1","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/58.0.3063.84 Safari/537.32","notable":false}],"distinct_sets":2,"events_with_headers":3},"tags":[],"data_as_of":"2026-09-23T16:10:43.689834+00:00"}