{"ip":"18.97.5.29","total_events":59,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"crowdstrikefalconsurface","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (crowdstrikefalconsurface).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"3,285 bytes sent","bytes_sent":3285,"session_seconds":0,"persistent":false}},"first_seen":"2026-03-19T03:14:19","last_seen":"2026-09-23T05:03:36","events_24h":13,"events_7d":13,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Ashburn","lat":39.0469,"lon":-77.4903,"asn":14618,"org":"Amazon.com, Inc."},"source_domain":"scanner-18-97-5-29.reposify.net","known_scanners":["crowdstrikefalconsurface","Reposify (CrowdStrike)"],"scanner_tag":{"key":"reposify","label":"Reposify (CrowdStrike)","category":"commercial","url":"https://www.crowdstrike.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":2376,"proto":"tcp","label":"Docker-TLS","count":13},{"port":50470,"proto":"tcp","label":"","count":12},{"port":993,"proto":"tcp","label":"IMAPS","count":12},{"port":58603,"proto":"tcp","label":"","count":11},{"port":50035,"proto":"tcp","label":"","count":2},{"port":19890,"proto":"tcp","label":"","count":2},{"port":50030,"proto":"tcp","label":"","count":2},{"port":9080,"proto":"tcp","label":"","count":1},{"port":873,"proto":"tcp","label":"Rsync","count":1},{"port":7547,"proto":"tcp","label":"TR-069","count":1},{"port":445,"proto":"tcp","label":"SMB","count":1},{"port":11211,"proto":"tcp","label":"Memcached","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i4311h1_c7886603b240_b26ce05bbdd6","t13d041000_16476d049b0b_78f1d400d464","t13i3612h1_bcee18a5b459_8537cf56674e"],"tls_client_hello":"16030100e7010000e3030307f6986dd61211e2e5c95919c2766de0c320e012f9371482fd7b2e4c79eebe9920ebe7e025f1be0a38c36130dee663876770469325730c8c8a1048b26e83e397a3000813021303130100ff0100009200000011000f00000c32332e39342e33372e323237000b000403000102000a000c000a001d0017001e00190018002300000016000000170000000d001e001c040305030603080708080809080a080b080408050806040105010601002b0003020304002d00020101003300260024001d0020c7e592576492b70606ef1aa6c3ebda9c40c29aa485bf50c739c60a","tls_ja3":["d18b223ce817c861b7829130500395c2","a66e498c488aa0523759691248cdfb01"],"http_akin":["a11cun050_0000004f_0d8a8ff5"]},"fingerprint_peers":{"t13i4311h1_c7886603b240_b26ce05bbdd6":20,"t13d041000_16476d049b0b_78f1d400d464":123,"t13i3612h1_bcee18a5b459_8537cf56674e":296,"a11cun050_0000004f_0d8a8ff5":84},"akin_families":{"a11cun050_0000004f_0d8a8ff5":{"head":"a11cun050_0000004f_0d8a8ff5","shapes":2,"ips":86}},"user_agents":["Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/58.0.3046.80 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3106.97 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/55.0.3016.100 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/51.0.3056.108 Safari/537.32","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/50.0.3112.113 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3029.98 Safari/537.32"],"timeline":[{"date":"2026-07-02","count":1},{"date":"2026-07-19","count":2},{"date":"2026-07-29","count":1},{"date":"2026-08-18","count":2},{"date":"2026-08-20","count":1},{"date":"2026-08-21","count":2},{"date":"2026-09-05","count":1},{"date":"2026-09-23","count":13}],"recent_events":[{"timestamp":"2026-09-23T05:03:36","port":2376,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0003\u0001\u0000\u0002\u0002P","payload_hex":"15030100020250","method":"","user_agent":"","ja3":"","session":"fcb5e03a-f578-428c-b733-32fc35ae942e","seq":1,"duration_ms":0,"bytes_in":7,"bytes_out":10},{"timestamp":"2026-09-23T05:03:36","port":2376,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0003\u0001\u0000\u0002\u0002P","payload_hex":"15030100020250","method":"","user_agent":"","ja3":"","session":"012b1143-c907-4a54-b301-cf6165923b34","seq":1,"duration_ms":0,"bytes_in":7,"bytes_out":10},{"timestamp":"2026-09-23T05:03:28","port":2376,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0007\u0000�%�!�C���ՒF�^Ր�","payload_hex":"801c0100020003000000100700c025f021c443a985aad59246e45ed5909c","method":"","user_agent":"","ja3":"","session":"138b0941-df60-44b5-9f39-9dfde34ca967","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-09-23T05:03:23","port":2376,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0004\u0000�$Ņ��M�����/�;��","payload_hex":"801c01000200030000001004008024c585ded74ddbffa99cff2fff3bc0d8","method":"","user_agent":"","ja3":"","session":"80186b3a-719a-46cd-99df-61b7bd3fbfbb","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-09-23T05:03:23","port":2376,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0003\u0000��<��2\u0005��A�,��7(P","payload_hex":"801c010002000300000010030080ec3cffe03205e9b141b62cc9e4372850","method":"","user_agent":"","ja3":"","session":"fa28405a-f2b5-4f29-a851-50cf57e12fc5","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-09-23T05:03:18","port":2376,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0006\u0000@��\u001d�*��i�snf\"َ}","payload_hex":"801c010002000300000010060040839f1dc82aff9369ea736e6622d98e7d","method":"","user_agent":"","ja3":"","session":"1b79dfd9-dbca-4b79-b1ee-35bf7e5d35f0","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":10,"enriched":{"digest":"eac6bc751a3ff7fc","strings":["snf\""]}},{"timestamp":"2026-09-23T05:03:18","port":2376,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0001\u0000�}��$s̲��q\bM1�\u001c�","payload_hex":"801c0100020003000000100100807decc72473ccb2adbf71084d31af1cdf","method":"","user_agent":"","ja3":"","session":"3bdb6525-ec68-436a-a790-291dd96fac1b","seq":1,"duration_ms":101,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-09-23T05:03:13","port":2376,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0002\u0000�.B�#�I�t�R�\u0018K�,�","payload_hex":"801c0100020003000000100200802e42bf23fe499774a152f6184bf72cfa","method":"","user_agent":"","ja3":"","session":"510c7aa5-b54a-485b-8989-fe886cc419fa","seq":1,"duration_ms":101,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-09-23T05:03:13","port":2376,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0005\u0000�\u0016\u0011�\u0001\u000b����O�`��!�","payload_hex":"801c0100020003000000100500801611d8010bc9ed8be24fad60b89421ca","method":"","user_agent":"","ja3":"","session":"a5f3b9ba-4cb8-4dd3-a34e-25ecbb6d37ee","seq":1,"duration_ms":101,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-09-23T05:03:08","port":2376,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"A","payload_hex":"41","method":"","user_agent":"","ja3":"a66e498c488aa0523759691248cdfb01","session":"07d3ce78-27ec-47ca-803a-512974c719b1","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":10}],"http_methods":[{"method":"GET","count":15}],"distinct_ports_total":12,"top_paths":[{"path":"/","count":14,"ports":9},{"path":"/containers/json?all=1","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[{"value":"localhost","count":3}],"top_alpns":[{"value":"http/1.1","count":9}],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-23T13:30:39.979893+00:00"}