{"ip":"18.97.5.3","total_events":45,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"crowdstrikefalconsurface","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (crowdstrikefalconsurface).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,883 bytes sent","bytes_sent":4883,"session_seconds":0,"persistent":false}},"first_seen":"2026-03-24T04:24:19","last_seen":"2026-10-01T04:30:48","events_24h":8,"events_7d":9,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Ashburn","lat":39.0469,"lon":-77.4903,"asn":14618,"org":"Amazon.com, Inc."},"source_domain":"scanner-18-97-5-3.reposify.net","known_scanners":["crowdstrikefalconsurface","Reposify (CrowdStrike)"],"scanner_tag":{"key":"reposify","label":"Reposify (CrowdStrike)","category":"commercial","url":"https://www.crowdstrike.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":222,"proto":"tcp","label":"","count":13},{"port":1024,"proto":"tcp","label":"","count":11},{"port":8082,"proto":"tcp","label":"","count":7},{"port":19200,"proto":"tcp","label":"","count":3},{"port":5900,"proto":"tcp","label":"VNC","count":2},{"port":8880,"proto":"tcp","label":"","count":1},{"port":873,"proto":"tcp","label":"Rsync","count":1},{"port":6467,"proto":"tcp","label":"","count":1},{"port":137,"proto":"tcp","label":"NetBIOS","count":1},{"port":7170,"proto":"tcp","label":"","count":1},{"port":6379,"proto":"tcp","label":"Redis","count":1},{"port":1443,"proto":"tcp","label":"","count":1},{"port":8085,"proto":"tcp","label":"","count":1},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i4311h1_c7886603b240_b26ce05bbdd6"],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun060_0004001f_f6be99b4","b11cun061_00050013_f5830403_x0659","b11cun050_00040017_345c845b","b11cun050_00040017_976354f0"]},"fingerprint_peers":{"t13i4311h1_c7886603b240_b26ce05bbdd6":14,"b11cun060_0004001f_f6be99b4":4,"b11cun061_00050013_f5830403_x0659":51,"b11cun050_00040017_345c845b":462,"b11cun050_00040017_976354f0":1279},"akin_families":{"b11cun060_0004001f_f6be99b4":{"head":"b11cun050_00040017_345c845b","shapes":2,"ips":462},"b11cun050_00040017_345c845b":{"head":"b11cun050_00040017_345c845b","shapes":2,"ips":462},"b11cun050_00040017_976354f0":{"head":"b11cun050_00040017_976354f0","shapes":2,"ips":1279}},"user_agents":["Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/52.0.3012.77 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/51.0.3082.94 Safari/537.32","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/60.0.3028.100 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/56.0.3002.67 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/51.0.3032.77 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/55.0.3091.97 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3052.100 Safari/537.32"],"timeline":[{"date":"2026-07-10","count":1},{"date":"2026-08-20","count":1},{"date":"2026-08-26","count":1},{"date":"2026-08-31","count":3},{"date":"2026-09-11","count":1},{"date":"2026-09-16","count":2},{"date":"2026-09-18","count":1},{"date":"2026-09-30","count":1},{"date":"2026-10-01","count":8}],"recent_events":[{"timestamp":"2026-10-01T04:30:48","port":137,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000\u0000","payload_hex":"81000000","method":"","user_agent":"","ja3":"","session":"47138a78-02ce-4936-9567-3908e7c2db12","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":9},{"timestamp":"2026-10-01T00:58:50","port":8082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8082\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e302e302e30205361666172692f3533372e33360d0a4163636570742d656e636f64696e673a20677a69700d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","ja3":"","session":"b670e7d4-aa51-45eb-9f39-83a0b0e39174","seq":1,"duration_ms":100,"bytes_in":235,"bytes_out":73},{"timestamp":"2026-10-01T00:58:50","port":8082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8082\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/51.0.3029.85 Safari/537.32\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038320d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e323b656e2d555329204170706c655765624b69742f3533372e33322e333620284b48544d4c2c206c697665204765636b6f29204368726f6d652f35312e302e333032392e3835205361666172692f3533372e33320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/51.0.3029.85 Safari/537.32","ja3":"","session":"691fafcd-a6b7-4cb4-bf72-d20024db35ff","seq":1,"duration_ms":100,"bytes_in":237,"bytes_out":73},{"timestamp":"2026-10-01T00:58:45","port":8082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"application/json,*/*;q=0.8\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/60.0.3028.100 Safari/537.32\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/swagger.json","summary":"","payload_hex":"474554202f737761676765722e6a736f6e20485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e323b656e2d555329204170706c655765624b69742f3533372e33322e333620284b48544d4c2c206c697665204765636b6f29204368726f6d652f36302e302e333032382e313030205361666172692f3533372e33320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a486f73743a206c6f63616c686f73740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/60.0.3028.100 Safari/537.32","ja3":"","session":"b2f17489-23b7-4c4a-9461-205492c147da","seq":1,"duration_ms":100,"bytes_in":292,"bytes_out":73},{"timestamp":"2026-10-01T00:58:45","port":8082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"application/json,*/*;q=0.8\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/51.0.3082.94 Safari/537.32\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/openapi.json","summary":"","payload_hex":"474554202f6170692f6f70656e6170692e6a736f6e20485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e323b656e2d555329204170706c655765624b69742f3533372e33322e333620284b48544d4c2c206c697665204765636b6f29204368726f6d652f35312e302e333038322e3934205361666172692f3533372e33320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a486f73743a206c6f63616c686f73740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/51.0.3082.94 Safari/537.32","ja3":"","session":"398c914c-d86d-4938-b98f-37e984f7a02c","seq":1,"duration_ms":100,"bytes_in":295,"bytes_out":73},{"timestamp":"2026-10-01T00:58:45","port":8082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"application/json,*/*;q=0.8\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/58.0.3022.74 Safari/537.32\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/openapi.json","summary":"","payload_hex":"474554202f76312f6f70656e6170692e6a736f6e20485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e323b656e2d555329204170706c655765624b69742f3533372e33322e333620284b48544d4c2c206c697665204765636b6f29204368726f6d652f35382e302e333032322e3734205361666172692f3533372e33320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a486f73743a206c6f63616c686f73740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/58.0.3022.74 Safari/537.32","ja3":"","session":"022b8efd-0f03-4356-8bc4-7c38c18e6723","seq":1,"duration_ms":100,"bytes_in":294,"bytes_out":73},{"timestamp":"2026-10-01T00:58:45","port":8082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"application/json,*/*;q=0.8\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/56.0.3051.101 Safari/537.32\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api-docs","summary":"","payload_hex":"474554202f6170692d646f637320485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e323b656e2d555329204170706c655765624b69742f3533372e33322e333620284b48544d4c2c206c697665204765636b6f29204368726f6d652f35362e302e333035312e313031205361666172692f3533372e33320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a486f73743a206c6f63616c686f73740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/56.0.3051.101 Safari/537.32","ja3":"","session":"834fe0a7-60a1-4518-9ee7-63b3e305a319","seq":1,"duration_ms":100,"bytes_in":288,"bytes_out":73},{"timestamp":"2026-10-01T00:58:44","port":8082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"application/json,*/*;q=0.8\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3052.100 Safari/537.32\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/openapi.json","summary":"","payload_hex":"474554202f6f70656e6170692e6a736f6e20485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e323b656e2d555329204170706c655765624b69742f3533372e33322e333620284b48544d4c2c206c697665204765636b6f29204368726f6d652f35392e302e333035322e313030205361666172692f3533372e33320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a486f73743a206c6f63616c686f73740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3052.100 Safari/537.32","ja3":"","session":"2a48bd78-3eeb-419d-a6b9-f220ddabad25","seq":1,"duration_ms":100,"bytes_in":292,"bytes_out":73},{"timestamp":"2026-09-30T14:55:57","port":8085,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8085\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/56.0.3002.67 Safari/537.32\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038350d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e323b656e2d555329204170706c655765624b69742f3533372e33322e333620284b48544d4c2c206c697665204765636b6f29204368726f6d652f35362e302e333030322e3637205361666172692f3533372e33320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/56.0.3002.67 Safari/537.32","ja3":"","session":"0db17fa7-bf73-4532-89b2-1c38e9e497a7","seq":1,"duration_ms":100,"bytes_in":236,"bytes_out":73},{"timestamp":"2026-09-18T07:06:36","port":7170,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:7170\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/55.0.3091.97 Safari/537.32\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373137300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e323b656e2d555329204170706c655765624b69742f3533372e33322e333620284b48544d4c2c206c697665204765636b6f29204368726f6d652f35352e302e333039312e3937205361666172692f3533372e33320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/55.0.3091.97 Safari/537.32","ja3":"","session":"16ab439b-b71f-4bc3-9068-7e5de37d81b8","seq":1,"duration_ms":100,"bytes_in":236,"bytes_out":73}],"http_methods":[{"method":"GET","count":21}],"distinct_ports_total":14,"top_paths":[{"path":"/","count":14,"ports":11},{"path":"/_alias","count":1,"ports":1},{"path":"/*","count":1,"ports":1},{"path":"/api-docs","count":1,"ports":1},{"path":"/swagger.json","count":1,"ports":1},{"path":"/openapi.json","count":1,"ports":1},{"path":"/v1/openapi.json","count":1,"ports":1},{"path":"/api/openapi.json","count":1,"ports":1}],"distinct_paths_total":8,"top_snis":[],"top_hosts":[{"value":"localhost","count":5}],"top_alpns":[{"value":"http/1.1","count":3}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"application/json,*/*;q=0.8","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.5","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"localhost","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/60.0.3028.100 Safari/537.32","notable":false}],"distinct_sets":2,"events_with_headers":9},"tags":[],"data_as_of":"2026-10-01T16:08:54.070670+00:00"}