{"ip":"18.97.26.50","total_events":124,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"crowdstrikefalconsurface","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (crowdstrikefalconsurface).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,642 bytes sent","bytes_sent":4642,"session_seconds":0,"persistent":false}},"first_seen":"2026-03-18T19:33:22","last_seen":"2026-09-23T18:22:10","events_24h":0,"events_7d":2,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Ashburn","lat":39.0469,"lon":-77.4903,"asn":14618,"org":"Amazon.com, Inc."},"source_domain":"scanner-18-97-26-50.reposify.net","known_scanners":["crowdstrikefalconsurface","Reposify (CrowdStrike)"],"scanner_tag":{"key":"reposify","label":"Reposify (CrowdStrike)","category":"commercial","url":"https://www.crowdstrike.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":22},{"port":8181,"proto":"tcp","label":"","count":13},{"port":830,"proto":"tcp","label":"","count":13},{"port":1900,"proto":"tcp","label":"","count":13},{"port":443,"proto":"tcp","label":"HTTPS","count":12},{"port":61000,"proto":"tcp","label":"","count":11},{"port":9091,"proto":"tcp","label":"","count":11},{"port":2095,"proto":"tcp","label":"","count":8},{"port":1883,"proto":"tcp","label":"MQTT","count":3},{"port":554,"proto":"tcp","label":"","count":3},{"port":50065,"proto":"tcp","label":"","count":2},{"port":2000,"proto":"tcp","label":"","count":2},{"port":51005,"proto":"tcp","label":"","count":1},{"port":8889,"proto":"tcp","label":"","count":1},{"port":5672,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i4311h1_c7886603b240_b26ce05bbdd6","t13i3612h1_bcee18a5b459_8537cf56674e","t13i861100_5177063c590b_4375406afd5e","t13d041000_16476d049b0b_78f1d400d464"],"tls_client_hello":"16030106130100060f0303585ae104fd37db8e1b8a9fdbc9ed0d6e4b60b896cf792cd78a31fc8b7008d15320180ddbdffdd8ce047ee5827634fffddf8f709c3baa03f532c64f6a8cfd4988cc0048130213031301c02cc030c02bc02fcca9cca8009f009eccaac0adc0acc024c028c023c027c00ac014c009c013c09fc09e006b006700390033009d009cc09dc09c003d003c0035002f0100057eff01000100000b000403000102000a0012001011ec001d0017001e00180019010001010010000b000908687474702f312e31001600000017000000310000000d0036003409050906090404030503060308070808081a081b081c0809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003304ea04e811ec04c00479bb090826c464777fa69a164256338aae95b142d29379b7fa93db787d8fb401d4f93b4f2246b43b8441821eb9a37f7bacb0b3c08ba0954d2d1c4817d6962b66cf79282c702473c8bb1d8a462274e09db6350a560cc345ea6acfdb4fe49598d9ca1059b561f70135f887b4b4779ffec6b0aff6c275390126668ca158639f4b4ac4b46acce13f3ca07104b3417cf57ac930c7acd345270b2b3a8806825343163bc10c23ac9a3020183492c856401acc3e0c597c26776b17725ba0e44a531473e7544aa61c565fc1b7f4587e8a8986b1688d77ba6fe854531f6333b7e9a893447248e5b3b0fc0786a19789a506eae8a57ea234b81bc317b45762b17225b134b526c3c5603c488736dba57c90179636753c54800c3ca049c50703115ccfbbb1323933aa64971669065c766c4e4839991e59b2d9f588e1b0cab2581189e940e91687049152bd5c8e8285a2f60c26d882a04a5a15d7698aa7135abbb28f39c38ffb1727e630529d7a7b27a75d14b41727719a9ef670eb423d66bcc449b2279d6c12baf20cd4e16c08a32e4f2b52dfc86bcb16b7ad5193a531222d3280f56737df2c961eb8a86ffb527ac424b2226095d3297b210c1c6cc5af77956f42073630b600568695a675f54317f3e296feb945366a707144c94b622515935d1020a78200439d097117388f0fb63acba27515106a0476cc16331d38a898ef0b1b7f88b752e0038094181f761253e294fd8c74069cadab539d9cc56ced4c199b440b6bfcbc419b328d6740e1d24a2ed381f3442ea4922a094349e552bed09b51e5f95ec3c36d350b0350d980683252bf4c89eac7235db02cf2434bc6dba18ef9c8c552117791a0f7b76054b56dd022cede432150f13663204372b54a932b2876eab039da6cf6998dcabbb5783321fd7019f1ca51a9caa3aac8461edbc5a11475f6a9bfbf5bb55fa6535c8cb01a088e8f1a5b68a75c4e734412922a6e55495b96bd1e305f60255953b892145c93d0760d5b43b25e318c7fd085697bb7c23ac737d575e6d320ec8c946a03039a5599b099ca23c5aa35408de3d5868341017c0916ee8cbb1f5070c44041d4f819e8302cabe187edf43c1dfa746274b0f43811edc2addcb9036f5ab4da779bd9b6a560290e579520ca253e5257279371418eb01bb6e731d3520c37f72421a478027ca2647bccc30c65d5562d17428cd15326da9295ff8c364c31840dfa00f781c5e4ecb71856389b026608e333b6d87395950e45e55006c0278970574ed18d78a8c933a8034812ae735018925bbe6e867ed67481fad98eb3e3210670789b2b5ae0093968ec9adb71c8a5a2ce54e6cd21daaa679323161014c3ba7959ca0919208e2dd7bff841cd6d4b3974bc74bdf4c75698513b76c623429c01dccad118083d0a96e8851ac0836184449e0c06d0fe53372e219a1c40bcae7a67d7caa9c19286a3d02c7279235dd587a324bdfd993598537c75b31dcde57978500b626997c5532675f57aaa487ee6f56b331b8db2e27efe135048b61917c5c220ab459f45b352035f22ccc931b4842720cb3e319e827914edfc6689e806eb7057ff12826c8c08cca061fbb1c202cc2da0ea8c84d8c569da04a5d18a410b333b7457edc8b0bfb6bc84e227eaa2f55d7e8e703022d88898d9a7a96828d4032d6cedda771405cfb08315637e715f332f85a9167f3db47818f5e2d6009b5d23ad754025001d0020d172899169a1863c6a5c639c7da928f6e549e3525d5fc707a3456bd166b84731001b000504000100","tls_ja3":["d18b223ce817c861b7829130500395c2","88d1ead6233d2e7df3ce89d5f4d4184f","a66e498c488aa0523759691248cdfb01"],"http_akin":["b11cun050_00040017_345c845b","b11cun120_011403df_782553ac","b11cun050_00040017_976354f0"]},"fingerprint_peers":{"t13i4311h1_c7886603b240_b26ce05bbdd6":14,"t13i3612h1_bcee18a5b459_8537cf56674e":300,"t13d041000_16476d049b0b_78f1d400d464":128,"b11cun050_00040017_345c845b":467,"b11cun120_011403df_782553ac":220,"b11cun050_00040017_976354f0":1281,"t13i861100_5177063c590b_4375406afd5e":9},"akin_families":{"b11cun050_00040017_345c845b":{"head":"b11cun050_00040017_976354f0","shapes":6,"ips":1281},"b11cun050_00040017_976354f0":{"head":"b11cun050_00040017_976354f0","shapes":6,"ips":1281}},"user_agents":["Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/57.0.3006.67 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3078.67 Safari/537.32","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3030.91 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/54.0.3052.101 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/58.0.3073.56 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/58.0.3087.72 Safari/537.32"],"timeline":[{"date":"2026-07-11","count":12},{"date":"2026-07-19","count":3},{"date":"2026-07-24","count":1},{"date":"2026-08-02","count":2},{"date":"2026-08-03","count":1},{"date":"2026-08-11","count":1},{"date":"2026-09-09","count":1},{"date":"2026-09-12","count":12},{"date":"2026-09-17","count":1},{"date":"2026-09-18","count":3},{"date":"2026-09-23","count":2}],"recent_events":[{"timestamp":"2026-09-23T18:22:10","port":50065,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:50065\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3030.91 Safari/537.32\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35303036350d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e323b656e2d555329204170706c655765624b69742f3533372e33322e333620284b48544d4c2c206c697665204765636b6f29204368726f6d652f35392e302e333033302e3931205361666172692f3533372e33320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3030.91 Safari/537.32","ja3":"","session":"a6724efa-4d9e-4cbc-a6bd-03e4808d743e","seq":1,"duration_ms":100,"bytes_in":238,"bytes_out":76},{"timestamp":"2026-09-23T18:22:09","port":50065,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"application/json, text/plain, */*; q=0.01\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"en-US,en;q=0.9\",\"cache-control\":\"no-cache\",\"connection\":\"keep-alive\",\"dnt\":\"1\",\"host\":\"localhost\",\"sec-fetch-dest\":\"document\",\"sec-fetch-mode\":\"navigate\",\"sec-fetch-site\":\"none\",\"sec-fetch-user\":\"?1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/58.0.3073.56 Safari/537.32\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e323b656e2d555329204170706c655765624b69742f3533372e33322e333620284b48544d4c2c206c697665204765636b6f29204368726f6d652f35382e302e333037332e3536205361666172692f3533372e33320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f706c61696e2c202a2f2a3b20713d302e30310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a5365632d46657463682d446573743a20646f63756d656e740d0a5365632d46657463682d4d6f64653a206e617669676174650d0a5365632d46657463682d536974653a206e6f6e650d0a5365632d46657463682d557365723a203f310d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a444e543a20310d0a486f73743a206c6f63616c686f73740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/58.0.3073.56 Safari/537.32","ja3":"d18b223ce817c861b7829130500395c2","session":"671f903f-83f2-436f-8540-8fe0565eb679","seq":1,"duration_ms":101,"bytes_in":430,"bytes_out":76},{"timestamp":"2026-09-18T04:03:20","port":1883,"proto":"tcp","app_proto":"","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0010$\u0000\u0006MQIsdp\u0003\u0002\u0000<\u0000\u00164rapC8JgKuOBnsAOd5cRbz","payload_hex":"102400064d51497364700302003c00163472617043384a674b754f426e73414f64356352627a","method":"","user_agent":"","ja3":"","session":"bb0b835a-0814-4c2b-a1bd-9d66496be0fc","seq":1,"duration_ms":100,"bytes_in":38,"bytes_out":11,"enriched":{"digest":"0bcbdfeec84ba788","strings":["MQIsdp","4rapC8JgKuOBnsAOd5cRbz"]}},{"timestamp":"2026-09-18T04:03:20","port":1883,"proto":"tcp","app_proto":"","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u00100\u0000\u0004MQTT\u0004\u0002\u0000<\u0000$a5860884-a7a6-4058-909a-54be7f81c746","payload_hex":"103000044d5154540402003c002461353836303838342d613761362d343035382d393039612d353462653766383163373436","method":"","user_agent":"","ja3":"","session":"d5edda44-5eaa-41da-a65e-48dbead466f7","seq":1,"duration_ms":100,"bytes_in":50,"bytes_out":11,"enriched":{"digest":"51fd9e337dc4fe40","label":"MQTT","strings":["MQTT","$a5860884-a7a6-4058-909a-54be7f81c746","<$a5860884-a7a6-4058-909a-54be7f81c746"]}},{"timestamp":"2026-09-18T04:03:20","port":1883,"proto":"tcp","app_proto":"","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u00101\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000$27d7b6b8-d3fa-4be6-8b9f-55bb23ca7d2f","payload_hex":"103100044d5154540502003c00002432376437623662382d643366612d346265362d386239662d353562623233636137643266","method":"","user_agent":"","ja3":"","session":"c0e43df0-c0ed-4c3f-9296-c8e4053e44d5","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":11,"enriched":{"digest":"b5a600600564493a","label":"MQTT","strings":["MQTT","$27d7b6b8-d3fa-4be6-8b9f-55bb23ca7d2f","<$27d7b6b8-d3fa-4be6-8b9f-55bb23ca7d2f"]}},{"timestamp":"2026-09-17T06:13:22","port":8889,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8889\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/54.0.3052.101 Safari/537.32\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383838390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e323b656e2d555329204170706c655765624b69742f3533372e33322e333620284b48544d4c2c206c697665204765636b6f29204368726f6d652f35342e302e333035322e313031205361666172692f3533372e33320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/54.0.3052.101 Safari/537.32","ja3":"","session":"9e4d6991-15c0-4ddf-8348-cb8a2627516b","seq":1,"duration_ms":100,"bytes_in":237,"bytes_out":76},{"timestamp":"2026-09-12T05:04:58","port":8443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0003\u0001\u0000\u0002\u0002P","payload_hex":"15030100020250","method":"","user_agent":"","ja3":"","session":"1410ed58-76da-4412-8732-143e1503b764","seq":1,"duration_ms":0,"bytes_in":7,"bytes_out":11},{"timestamp":"2026-09-12T05:04:56","port":8443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0003\u0001\u0000\u0002\u0002P","payload_hex":"15030100020250","method":"","user_agent":"","ja3":"","session":"5aa71da2-5172-4641-bc7e-c669d57376ca","seq":1,"duration_ms":0,"bytes_in":7,"bytes_out":11},{"timestamp":"2026-09-12T05:04:47","port":8443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0005\u0000���\u0001�ϰ:Q�\u001d7]#l�[","payload_hex":"801c010002000300000010050080aec301f3cfb03a51db1d375d236ce25b","method":"","user_agent":"","ja3":"","session":"cb8ec3e8-9bfb-4360-8426-e3450e6edde8","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":11,"enriched":{"digest":"2b2f5af3e7b7354c","strings":["7]#l"]}},{"timestamp":"2026-09-12T05:04:42","port":8443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0007\u0000����빿���[���]>X","payload_hex":"801c0100020003000000100700c0e089b9ebb9bfbc9ce55b88eead5d3e58","method":"","user_agent":"","ja3":"","session":"c47ba0f0-7d32-45fc-a604-7e1eb032e765","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":11}],"http_methods":[{"method":"GET","count":27}],"distinct_ports_total":23,"top_paths":[{"path":"/","count":27,"ports":20}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"localhost","count":1}],"top_alpns":[{"value":"http/1.1","count":13}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Cache-Control","Connection","Dnt","Host","Sec-Fetch-Dest","Sec-Fetch-Mode","Sec-Fetch-Site","Sec-Fetch-User","User-Agent"],"representative":[{"name":"Accept","value":"application/json, text/plain, */*; q=0.01","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate, br","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.9","notable":false},{"name":"Cache-Control","value":"no-cache","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Dnt","value":"1","notable":false},{"name":"Host","value":"localhost","notable":false},{"name":"Sec-Fetch-Dest","value":"document","notable":false},{"name":"Sec-Fetch-Mode","value":"navigate","notable":false},{"name":"Sec-Fetch-Site","value":"none","notable":false},{"name":"Sec-Fetch-User","value":"?1","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/58.0.3073.56 Safari/537.32","notable":false}],"distinct_sets":2,"events_with_headers":3},"tags":[],"data_as_of":"2026-09-30T16:08:34.443571+00:00"}