{"ip":"18.97.26.118","total_events":42,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"crowdstrikefalconsurface","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (crowdstrikefalconsurface).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"2,228 bytes sent","bytes_sent":2228,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-28T17:07:04","last_seen":"2026-08-13T21:00:25","events_24h":0,"events_7d":20,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Ashburn","lat":39.0469,"lon":-77.4903,"asn":14618,"org":"Amazon.com, Inc."},"source_domain":"scanner-18-97-26-118.reposify.net","known_scanners":["crowdstrikefalconsurface","Reposify (CrowdStrike)"],"scanner_tag":{"key":"reposify","label":"Reposify (CrowdStrike)","category":"commercial","url":"https://www.crowdstrike.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":6002,"proto":"tcp","label":"","count":21},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":12},{"port":554,"proto":"tcp","label":"","count":3},{"port":6666,"proto":"tcp","label":"","count":3},{"port":8008,"proto":"tcp","label":"HTTP-alt","count":1},{"port":2096,"proto":"tcp","label":"","count":1},{"port":32400,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i4311h1_c7886603b240_b26ce05bbdd6","t13d041000_16476d049b0b_78f1d400d464","t13i3612h1_bcee18a5b459_8537cf56674e"],"tls_ja3":["d18b223ce817c861b7829130500395c2","a66e498c488aa0523759691248cdfb01"],"ja4h":["ge11nn0500_2d30dc89d981"]},"fingerprint_peers":{"t13i3612h1_bcee18a5b459_8537cf56674e":325,"t13i4311h1_c7886603b240_b26ce05bbdd6":9,"t13d041000_16476d049b0b_78f1d400d464":128,"ge11nn0500_2d30dc89d981":1345},"user_agents":["Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/57.0.3087.105 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/60.0.3029.104 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3000.68 Safari/537.32","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/50.0.3030.78 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/54.0.3074.84 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/55.0.3069.109 Safari/537.32"],"timeline":[{"date":"2026-07-11","count":1},{"date":"2026-08-10","count":3},{"date":"2026-08-11","count":4},{"date":"2026-08-12","count":12},{"date":"2026-08-13","count":1}],"recent_events":[{"timestamp":"2026-08-13T21:00:25","port":8008,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8008\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/55.0.3069.109 Safari/537.32\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e323b656e2d555329204170706c655765624b69742f3533372e33322e333620284b48544d4c2c206c697665204765636b6f29204368726f6d652f35352e302e333036392e313039205361666172692f3533372e33320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/55.0.3069.109 Safari/537.32","ja3":"","session":"58e71f54-e1e8-4966-892e-bf610cb42901","seq":1,"duration_ms":100,"bytes_in":238,"bytes_out":77},{"timestamp":"2026-08-12T15:01:25","port":8443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0003\u0001\u0000\u0002\u0002P","payload_hex":"15030100020250","method":"","user_agent":"","ja3":"","session":"9884afe7-bc73-4248-be59-d6573b8bcd1d","seq":1,"duration_ms":0,"bytes_in":7,"bytes_out":12},{"timestamp":"2026-08-12T15:01:25","port":8443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0003\u0001\u0000\u0002\u0002P","payload_hex":"15030100020250","method":"","user_agent":"","ja3":"","session":"bda8494c-1172-4e70-a8e0-a4d6ed67fabc","seq":1,"duration_ms":0,"bytes_in":7,"bytes_out":12},{"timestamp":"2026-08-12T15:01:13","port":8443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0006\u0000@\u000f8V\u001el��\u0015I���|mњ","payload_hex":"801c0100020003000000100600400f38561e6c83c2154996bf977c6dd19a","method":"","user_agent":"","ja3":"","session":"e946fe84-7c86-4412-af78-565afc3d87f6","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":12},{"timestamp":"2026-08-12T15:01:08","port":8443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0003\u0000���p\u0006�P1P�����K��","payload_hex":"801c010002000300000010030080b3a07006ef503150e485e08cde4b92d2","method":"","user_agent":"","ja3":"","session":"b4430d29-5162-421d-97f4-f7ffb30b4786","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":12},{"timestamp":"2026-08-12T15:01:08","port":8443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0004\u0000����;\"qu\t�0��K��k","payload_hex":"801c010002000300000010040080ece1863b227175098030bcce4b88846b","method":"","user_agent":"","ja3":"","session":"e74198ad-3fd6-4694-9dd5-39dbddb750ea","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":12,"enriched":{"digest":"774431d8d8a553a6","strings":[";\"qu"]}},{"timestamp":"2026-08-12T15:01:02","port":8443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0007\u0000�\u000f���K�X��>=�ѧ\u001f�","payload_hex":"801c0100020003000000100700c00f97e7eb4baa58c7cc3e3da7d1a71fa3","method":"","user_agent":"","ja3":"","session":"51bb933c-6144-4853-947c-6fbc83951b93","seq":1,"duration_ms":103,"bytes_in":30,"bytes_out":12},{"timestamp":"2026-08-12T15:01:02","port":8443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0002\u0000�I��L�^_c���[(�\u001eK","payload_hex":"801c01000200030000001002008049e5ae4ce85e5f63c6f7995b28b01e4b","method":"","user_agent":"","ja3":"","session":"6dfe0bc8-e31c-41bf-a001-cfae7a68691c","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":12},{"timestamp":"2026-08-12T15:00:57","port":8443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0001\u0000����}�;�\"�iD��\u0006r�","payload_hex":"801c010002000300000010010080eae8fe7d9d3b9e22e06944bf970672e5","method":"","user_agent":"","ja3":"","session":"aa713421-c9da-484d-8c44-3964248693c7","seq":1,"duration_ms":101,"bytes_in":30,"bytes_out":12},{"timestamp":"2026-08-12T15:00:57","port":8443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0005\u0000�l��U\u0007q�x��Z[r2�-","payload_hex":"801c0100020003000000100500806cffa2550771fd7891c25a5b72328b2d","method":"","user_agent":"","ja3":"","session":"73fde951-06ef-4bab-95a0-3788b77c4468","seq":1,"duration_ms":101,"bytes_in":30,"bytes_out":12,"enriched":{"digest":"f947ca9c1b00d281","strings":["Z[r2"]}}],"http_methods":[{"method":"GET","count":9}],"distinct_ports_total":7,"top_paths":[{"path":"/","count":9,"ports":7}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":2}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:8008","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/55.0.3069.109 Safari/537.32","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-08-15T11:40:28.747950+00:00"}