{"ip":"18.97.5.80","total_events":103,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"crowdstrikefalconsurface","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (crowdstrikefalconsurface).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,784 bytes sent","bytes_sent":6784,"session_seconds":8,"persistent":false}},"first_seen":"2026-02-24T09:16:16","last_seen":"2026-08-15T04:04:40","events_24h":13,"events_7d":13,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Ashburn","lat":39.0469,"lon":-77.4903,"asn":14618,"org":"Amazon.com, Inc."},"source_domain":"scanner-18-97-5-80.reposify.net","known_scanners":["crowdstrikefalconsurface","Reposify (CrowdStrike)"],"scanner_tag":{"key":"reposify","label":"Reposify (CrowdStrike)","category":"commercial","url":"https://www.crowdstrike.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":8200,"proto":"tcp","label":"","count":30},{"port":8012,"proto":"tcp","label":"","count":21},{"port":8088,"proto":"tcp","label":"Hadoop","count":19},{"port":2376,"proto":"tcp","label":"Docker-TLS","count":13},{"port":3389,"proto":"tcp","label":"RDP","count":4},{"port":53,"proto":"tcp","label":"DNS","count":4},{"port":9201,"proto":"tcp","label":"","count":3},{"port":587,"proto":"tcp","label":"SMTP","count":2},{"port":50070,"proto":"tcp","label":"Hadoop","count":2},{"port":50091,"proto":"tcp","label":"","count":2},{"port":1433,"proto":"tcp","label":"MSSQL","count":1},{"port":6467,"proto":"tcp","label":"","count":1},{"port":58000,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i4311h1_c7886603b240_b26ce05bbdd6","t13d041000_16476d049b0b_78f1d400d464","t13i3612h1_bcee18a5b459_8537cf56674e"],"tls_ja3":["d18b223ce817c861b7829130500395c2","a66e498c488aa0523759691248cdfb01"],"ja4h":["ge11nn0600_9710a781d8b2","ge11nn12en_a3b5fcc7a26a","ge11nn0500_2d30dc89d981"]},"fingerprint_peers":{"t13i3612h1_bcee18a5b459_8537cf56674e":324,"t13i4311h1_c7886603b240_b26ce05bbdd6":9,"t13d041000_16476d049b0b_78f1d400d464":128,"ge11nn0500_2d30dc89d981":1339,"ge11nn0600_9710a781d8b2":55,"ge11nn12en_a3b5fcc7a26a":234},"user_agents":["Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3037.71 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/56.0.3040.110 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/54.0.3038.52 Safari/537.32","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/60.0.3098.110 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3014.76 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/60.0.3071.91 Safari/537.32"],"timeline":[{"date":"2026-05-23","count":2},{"date":"2026-06-16","count":2},{"date":"2026-07-04","count":2},{"date":"2026-07-05","count":4},{"date":"2026-07-07","count":1},{"date":"2026-07-26","count":1},{"date":"2026-07-31","count":4},{"date":"2026-08-01","count":1},{"date":"2026-08-08","count":3},{"date":"2026-08-15","count":13}],"recent_events":[{"timestamp":"2026-08-15T04:04:40","port":2376,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0003\u0001\u0000\u0002\u0002P","payload_hex":"15030100020250","method":"","user_agent":"","ja3":"","session":"7b76c39b-cc70-47aa-b36d-07e0d9038295","seq":1,"duration_ms":0,"bytes_in":7,"bytes_out":10},{"timestamp":"2026-08-15T04:04:38","port":2376,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0003\u0001\u0000\u0002\u0002P","payload_hex":"15030100020250","method":"","user_agent":"","ja3":"","session":"3ea1b31d-2f46-46bd-8434-973062154634","seq":1,"duration_ms":0,"bytes_in":7,"bytes_out":10},{"timestamp":"2026-08-15T04:04:30","port":2376,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0005\u0000�T\u0001\u0003�9�\"-n��\u0019�\u0014\u0003.","payload_hex":"801c010002000300000010050080540103f239e8222d6ee69f19c714032e","method":"","user_agent":"","ja3":"","session":"c7e931d8-6114-4220-824c-c08558a844e8","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-08-15T04:04:25","port":2376,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0004\u0000�t�\u0002�[��2'�ɋ웏\u0012","payload_hex":"801c01000200030000001004008074a102ad5badae3227f5c98bec9b8f12","method":"","user_agent":"","ja3":"","session":"44d25ac3-7731-46c1-a2b7-f8ca176c3977","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-08-15T04:04:25","port":2376,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0006\u0000@\u001a���;�q�1\u001cXH�2\\P","payload_hex":"801c0100020003000000100600401ac1bae63bbe71b8311c5848d0325c50","method":"","user_agent":"","ja3":"","session":"c5095363-5350-4853-95e7-ae7137290799","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-08-15T04:04:20","port":2376,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0002\u0000��8\u001e�돁�A��?�\u000f8|","payload_hex":"801c010002000300000010020080aa381eb5eb8f81ff41c1b13fa60f387c","method":"","user_agent":"","ja3":"","session":"f1af673b-c648-4144-8fd6-ecc3181071e4","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-08-15T04:04:20","port":2376,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0007\u0000��\u001c�\u001a�\u0011��\u0005�m\u0011u�,2","payload_hex":"801c0100020003000000100700c0f21c941ab1118ef105e16d1175f12c32","method":"","user_agent":"","ja3":"","session":"8a2bcfc8-1980-4688-b2a2-77e60b6da801","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-08-15T04:04:15","port":2376,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0003\u0000�9�J5��x3v����[U�","payload_hex":"801c01000200030000001003008039bd4a35869a7833768bc3f5ba5b55ea","method":"","user_agent":"","ja3":"","session":"d815c31d-743a-4df3-87fb-dc36c486fef4","seq":1,"duration_ms":101,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-08-15T04:04:15","port":2376,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0001\u0000�-��g�����m;��\u0017�B","payload_hex":"801c0100020003000000100100802df4cc678784bd87c16d3b96b5179542","method":"","user_agent":"","ja3":"","session":"fa1a9dfd-6169-467a-8585-00c1b2505016","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-08-15T04:04:15","port":2376,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"A","payload_hex":"41","method":"","user_agent":"","ja3":"a66e498c488aa0523759691248cdfb01","session":"efdbc771-3c9a-42b1-996f-67528f969408","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":10}],"http_methods":[{"method":"GET","count":21}],"distinct_ports_total":13,"top_paths":[{"path":"/","count":18,"ports":12},{"path":"/_alias","count":1,"ports":1},{"path":"/*","count":1,"ports":1},{"path":"/containers/json?all=1","count":1,"ports":1}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[{"value":"localhost","count":2}],"top_alpns":[{"value":"http/1.1","count":7}],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T23:42:30.995436+00:00"}